Threats affecting pkg:npm/node

A business logic flaw in Node.js 26.x's zlib.ZipFile API can cause it to return incorrect bytes from a ZIP archive when the local header does not match the central directory. This occurs because a validation error leaves a cached local header without a content offset, allowing attacker-controlled bytes to be returned while CRC-32 verification still passes. This discrepancy can cause Node.js-based ZIP scanners to approve different content than other ZIP implementations.

CVE-2026-56848 is a high-severity use-after-free vulnerability in Node.js HTTP/2 handling. It occurs when the function nghttp2_session_mem_send() is called re-entrantly during the execution of nghttp2_session_mem_recv(), leading to a heap-use-after-free condition. This flaw affects specific Node.js versions 26.5.0, 24.18.0, and 22.23.1. The vulnerability does not impact confidentiality or integrity but can cause denial of service due to application crashes. There is no confirmed patch or official remediation available at this time.

A vulnerability in Node.js versions 22.23.1, 24.18.0, and 26.5.0 exists where the dns.resolveAny() function aborts the Node.js process if a DNS response contains more than 256 A records. This can be repeatedly triggered to cause a denial of service condition. The issue is classified as CWE-400, indicating uncontrolled resource consumption. The CVSS v3.0 score is 5.9, reflecting a medium severity impact primarily affecting availability.

CVE-2026-56846 is a high-severity vulnerability in Node.js HTTP/2 handling that allows remote attackers to exhaust memory by evading maxSessionMemory limits through retained header blocks. It affects Node.js versions 22.23.1 and 24.18.0. The flaw results in uncontrolled resource consumption leading to denial of service. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-58044 is a low severity vulnerability in Node.js HTTP client affecting supported release lines 22, 24, and 26. It involves HTTP request smuggling due to request desynchronization in forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections. The flaw allows certain headers, including Content-Length, to be omitted from userland header objects but still used internally for HTTP framing, potentially causing inconsistencies.

A vulnerability in Node.js allows a specially crafted spoofed TypedArray byteLength to trigger an assertion failure in synchronous node:zlib APIs, causing the process to crash. This affects all 11 synchronous zlib functions and can be exploited repeatedly to cause denial of service. The issue impacts Node.js versions 22.x, 24.x, and 26.x. No official patch or remediation guidance is currently confirmed.

CVE-2026-58039 is a vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves improper access control in the Node.js permission model, allowing process.report to write or overwrite files outside the intended --allow-fs-write paths. This flaw can lead to confidentiality impacts or bypass of security boundaries under certain configurations. The vulnerability has a low severity rating with a CVSS score of 3.3.

CVE-2026-58040 is a vulnerability in Node.js versions 22.x, 24.x, and 26.x where the HTTPS Agent's TLS session reuse mechanism skips hostname verification across identity policies. This issue is an incomplete fix of a previous vulnerability (CVE-2026-48934). The vulnerability has a medium severity with a CVSS score of 6.3 and does not have any known exploits in the wild at this time.

A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

A memory leak vulnerability exists in Node.js HTTP/2 servers when clients send WINDOW_UPDATE frames on stream 0 that cause the flow control window to exceed the maximum allowed value. Although the server sends a GOAWAY frame correctly, the associated Http2Session object is not cleaned up, leading to resource leakage. This affects Node.js versions 20.20.1, 22.22.1, 24.14.