NodeJS Node vulnerabilities

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

nodejs · node

Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

nodejs · node

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

nodejs · node

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

nodejs · node

Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse

nodejs · node

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

nodejs · node

Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream

nodejs · node

Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA

nodejs · node

Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown

nodejs · node

Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown

nodejs · node