CVE Tools
Track your stack

Node

147 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Node, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Node CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Node CVEs per month
MonthCVEs
2024-120
2025-014
2025-021
2025-030
2025-040
2025-053
2025-060
2025-072
2025-080
2025-090
2025-100
2025-110
2025-120
2026-018
2026-020
2026-038
2026-040
2026-050
2026-0612
2026-075
2026-086
2026-091
2026-109
2026-1115

Severity

How the 147 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical128%
  • High6947%
  • Medium4933%
  • Low1712%

Latest CVEs

The 15 most recently published vulnerabilities affecting Node.

  1. CVE-2026-126051Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks7.5
  2. CVE-2026-123875Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled5.9
  3. CVE-2026-123874Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write7.5
  4. CVE-2026-123872Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change8.1
  5. CVE-2026-123877Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse6.8
  6. CVE-2026-123871Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages6.2
  7. CVE-2026-123868Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream5.9
  8. CVE-2026-123867Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA4.2
  9. CVE-2026-123866Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown7.5
  10. CVE-2026-123865Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown7.5
  11. CVE-2026-123864Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser8.1
  12. CVE-2026-123863Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown8.2
  13. CVE-2026-123862Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call2.9
  14. CVE-2026-123829Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch2.5
  15. CVE-2026-123828Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin5.9

Product grouping is registry-driven, with AI assist and human review. How it works