Threat database

Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where server certificates can be incorrectly validated against a different IP address when the host is specified as a non-canonical IPv4 literal with leading zeros. This occurs because the hostname normalization interprets leading-zero octets as octal, while the OS resolver interprets them as decimal, potentially allowing a server to be authenticated with a certificate issued for another IP address.

CVE-2026-105481 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Node.js HTTP Agent connection reuse mechanism. It allows a client to mistakenly accept a response sent before the corresponding request, due to incomplete handling of unsolicited responses on keep-alive sockets. This flaw affects Node.js versions 22.23.3, 24.22.0, and 26.12.0.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in DNS resolution functions where hostnames with embedded NUL bytes are truncated silently. This allows dns.resolve*() and dns.reverse() to resolve a different hostname than the one validated, potentially bypassing domain allowlist checks.

A vulnerability in Node.js affects the internal entropy caches used by crypto functions such as crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() when user-land startup snapshots or single executable applications are built with useSnapshot. If these functions are called during snapshot creation, the cached random values are reused across processes started from that snapshot, causing collisions and predictability of supposedly unique identifiers. This impacts Node.js versions 22.23.3, 24.22.0, and 26.12.0.

CVE-2026-106071 is a low-severity vulnerability in Node.js 26.x where the filesystem permission model improperly enforces wildcard path grants. Specifically, a wildcard rule such as --allow-fs-read=/etc/passwd.* can incorrectly allow access to /etc/passwd itself due to early termination in the radix tree lookup. This flaw requires the wildcard grant to be directly under the root of the permission tree and differs from CVE-2026-58043. The vulnerability has a CVSS score of 3.6 and affects Node.js version 26.12.0.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can authenticate IP endpoints if the client uses non-canonical IPv4 address spellings. This occurs because tls.checkServerIdentity() normalizes these addresses and matches them against DNS names, allowing improper validation. Exploitation requires a trusted CA to issue a certificate with a numeric DNS SAN and a platform resolver that accepts non-canonical IP formats.

Node.js versions 24.22.0 and 26.12.0 contain a vulnerability in TLS hostname verification where certificates without matching IP address SANs can authenticate connections to IPv4 addresses written with non-ASCII characters. This occurs because tls.checkServerIdentity() fails to recognize such hosts as IP addresses, leading to improper validation against DNS names or Common Names in certificates. This flaw is a regression from a previous fix and can allow acceptance of certificates not issued for the actual IP endpoint.

A business logic flaw in Node.js 26.x's zlib.ZipFile API can cause it to return incorrect bytes from a ZIP archive when local and central headers do not match. This occurs because the local header is cached without a content offset after validation failure, allowing attacker-controlled bytes to be returned while CRC-32 verification still passes. This discrepancy can cause Node.js-based scanners to approve different content than other ZIP implementations extract.

Node.js versions 22.23.3, 24.22.0, and 26.12.0 contain a flaw in the filesystem permission model where fs.realpathSync() does not enforce required read permission checks. This incomplete fix of a previous vulnerability allows code running with restricted filesystem read permissions to bypass these restrictions and access filesystem paths outside permitted directories. The vulnerability has a low severity score and does not impact integrity or availability.

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

CVE-2026-56848 is a high-severity use-after-free vulnerability in Node.js HTTP/2 handling. It occurs when the function nghttp2_session_mem_send() is called re-entrantly during the execution of nghttp2_session_mem_recv(), leading to a heap-use-after-free condition. This flaw affects specific Node.js versions 26.5.0, 24.18.0, and 22.23.1. The vulnerability does not impact confidentiality or integrity but can cause denial of service due to application crashes. There is no confirmed patch or official remediation available at this time.

A vulnerability in Node.js versions 22.23.1, 24.18.0, and 26.5.0 exists where the dns.resolveAny() function aborts the Node.js process if a DNS response contains more than 256 A records. This can be repeatedly triggered to cause a denial of service condition. The issue is classified as CWE-400, indicating uncontrolled resource consumption. The CVSS v3.0 score is 5.9, reflecting a medium severity impact primarily affecting availability.

CVE-2026-56846 is a high-severity vulnerability in Node.js HTTP/2 handling that allows remote attackers to exhaust memory by evading maxSessionMemory limits through retained header blocks. It affects Node.js versions 22.23.1 and 24.18.0. The flaw results in uncontrolled resource consumption leading to denial of service. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-58044 is a low severity vulnerability in Node.js HTTP client affecting supported release lines 22, 24, and 26. It involves HTTP request smuggling due to request desynchronization in forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while reusing backend connections. The flaw allows certain headers, including Content-Length, to be omitted from userland header objects but still used internally for HTTP framing, potentially causing inconsistencies.

A vulnerability in Node.js allows a specially crafted spoofed TypedArray byteLength to trigger an assertion failure in synchronous node:zlib APIs, causing the process to crash. This affects all 11 synchronous zlib functions and can be exploited repeatedly to cause denial of service. The issue impacts Node.js versions 22.x, 24.x, and 26.x. No official patch or remediation guidance is currently confirmed.

CVE-2026-58041 is a medium severity vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves a time-of-check to time-of-use (TOCTOU) race condition in the node:sqlite module, where a stale StatementSyncIterator can continue executing a cached prepared statement after it has been reset and rebound with new parameters. This occurs because SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases.

CVE-2026-58039 is a vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves improper access control in the Node.js permission model, allowing process.report to write or overwrite files outside the intended --allow-fs-write paths. This flaw can lead to confidentiality impacts or bypass of security boundaries under certain configurations. The vulnerability has a low severity rating with a CVSS score of 3.3.

CVE-2026-58040 is a vulnerability in Node.js versions 22.x, 24.x, and 26.x where the HTTPS Agent's TLS session reuse mechanism skips hostname verification across identity policies. This issue is an incomplete fix of a previous vulnerability (CVE-2026-48934). The vulnerability has a medium severity with a CVSS score of 6.3 and does not have any known exploits in the wild at this time.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.