p PatchFirst

PatchFirst · Vulnerabilidades recientes

node.js 25.8.1: vulnerabilidades conocidas

Vulnerabilidades conocidas que afectan a node.js 25.8.1: 8. Compara las versiones corregidas de abajo con la que tienes instalada.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 8

  1. CVE-2026-21710

    Alta · CVSS 7.5EPSS 25,04%Sin corrección publicada

    CVE-2026-21710

    A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-21716

    Baja · CVSS 3.3EPSS 0,15%Sin corrección publicada

    CVE-2026-21716

    An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-21711

    Media · CVSS 5.3EPSS 0,18%Sin corrección publicada

    CVE-2026-21711

    A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental featur

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-21715

    Baja · CVSS 3.3EPSS 0,16%Sin corrección publicada

    CVE-2026-21715

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-21717

    Media · CVSS 5.9EPSS 0,27%Sin corrección publicada

    CVE-2026-21717

    A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-21713

    Media · CVSS 5.9EPSS 0,39%Sin corrección publicada

    CVE-2026-21713

    A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. Node.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-21714

    Media · CVSS 5.3EPSS 0,45%Sin corrección publicada

    CVE-2026-21714

    A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

    node.jsNode.js
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →