Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: NodeJS Node 10.*, 11.* and 11 more versions Clear all filters
TI-2021-05801 CVE-2021-22940 · GHSA-6hhj-4h22-mrmm

Use after free in NodeJS Node

Priority MEDIUM 48

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13861 Published 2021-08-16 Partial fix · 12.22.5, 14.17.5 +1 CWE-416
TI-2021-05800 CVE-2021-22939 · GHSA-9mvv-4q4j-q2j8

Improper certificate validation in NodeJS Node

Priority MEDIUM 40

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.1473 Published 2021-08-16 Partial fix · 12.22.5, 14.17.5 +1 CWE-295
TI-2021-05792 CVE-2021-22931 · GHSA-7r9p-c88x-w357

Improper input validation in NodeJS Node

Priority HIGH 68

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21952 Published 2021-08-16 Partial fix · 12.22.5, 14.17.5 +1 CWE-170