Vulnerabilities

TI-2026-85814 CVE-2026-116630

undici information disclosure via cross-origin redirect revalidation

LOW 25

undici is an HTTP client for Node.js.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00148 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-346

TI-2026-85809 CVE-2026-120415

undici leaks cross-origin credentials via array-of-tuples headers on redirect

LOW 26

undici is an HTTP client for Node.js.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.003 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-200

TI-2026-85810 CVE-2026-120423

Subresource Integrity bypass in undici via whitespace in integrity metadata

LOW 25

undici is an HTTP client for Node.js.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00134 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-354

TI-2026-85807 CVE-2026-116592

Cache poisoning in undici via intermediate redirect hops

LOW 32

undici is an HTTP client for Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00157 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-346

TI-2026-85808 CVE-2026-120222

Unhandled exception in undici cache interceptor crashes Node.js process

LOW 26

undici is an HTTP client for Node.js.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00308 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-248

TI-2026-85805 CVE-2026-120474

Cross-user cache disclosure in undici via same-origin redirect

LOW 29

undici is an HTTP client for Node.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00288 Published 2026-11-06 Fixed in 7.30.2, 8.12.4 CWE-524

TI-2026-79960 CVE-2026-106069

Improper certificate validation in Node.js TLS IPv4 hostnames

LOW 34

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading…

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.00304 Published 2026-10-23 Partial fix CWE-295

TI-2026-79957 CVE-2026-105481

Node.js HTTP Agent accepts responses sent before the request

LOW 29

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.

CVSS 3.0MEDIUM 6.5 Network No auth No interaction EPSS 0.00318 Published 2026-10-23 Partial fix CWE-367

TI-2026-79958 CVE-2026-105482

NUL byte truncation of hostnames in Node.js DNS resolve functions

LOW 35

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse().

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.00468 Published 2026-10-23 Partial fix CWE-284

TI-2026-79965 CVE-2026-106074

Node.js crypto caches saved in snapshots repeat random values

LOW 22

A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single…

CVSS 3.0MEDIUM 4.8 Network No auth No interaction EPSS 0.00334 Published 2026-10-23 Partial fix CWE-330

TI-2026-79962 CVE-2026-106071

Node.js Permission Model grants file access outside wildcard rules

LOW 17

A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.

CVSS 3.0LOW 3.6 Local Low privileges No interaction EPSS 0.00199 Published 2026-10-23 Partial fix CWE-284

TI-2026-79963 CVE-2026-106072

Node.js TLS hostname verification accepts non-canonical IPv4 hosts

LOW 33

A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `21307…

CVSS 3.0MEDIUM 6.7 Network High privileges No interaction EPSS 0.00617 Published 2026-10-23 Partial fix CWE-295

TI-2026-79959 CVE-2026-105483

Node.js TLS hostname check accepts certificates for IPv4 hosts

LOW 34

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth dig…

CVSS 3.0HIGH 7.4 Network No auth No interaction EPSS 0.00304 Published 2026-10-23 Partial fix CWE-295

TI-2026-79961 CVE-2026-106070

Node.js ZipFile returns wrong bytes after header validation fails

LOW 18

A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails.

CVSS 3.0LOW 3.7 Network No auth No interaction EPSS 0.00367 Published 2026-10-23 Fix deferred CWE-840

TI-2026-79964 CVE-2026-106073

Missing read checks in Node.js Permission Model fs.realpathSync()

LOW 16

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.

CVSS 3.0LOW 3.3 Local Low privileges No interaction EPSS 0.00254 Published 2026-10-23 Partial fix CWE-284

TI-2026-79288 CVE-2026-111497 · GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

CRITICAL 99KEV

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.82641 Published 2026-10-22 Partial fix · 1.0.10, 1.1.1 +2 CWE-252

TI-2026-74993 CVE-2026-87029 · GHSA-55wc-3pg8-jfw6