p PatchFirst

PatchFirst · Vulnérabilités récentes

node.js 26.3.0 : vulnérabilités connues

Vulnérabilités connues concernant node.js 26.3.0 : 12. Comparez les versions corrigées ci-dessous avec celle que vous utilisez.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 12

  1. CVE-2026-48932

    Faible · CVSS 3.7EPSS 0,27%Aucun correctif publié

    CVE-2026-48932

    A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, a

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2026-48930

    Moyenne · CVSS 5.6EPSS 0,32%Aucun correctif publié

    CVE-2026-48930

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2026-48928

    Moyenne · CVSS 4.2EPSS 0,22%Aucun correctif publié

    CVE-2026-48928

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2026-48934

    Moyenne · CVSS 4.3EPSS 0,26%Aucun correctif publié

    CVE-2026-48934

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2026-48936

    Faible · CVSS 3.3EPSS 0,14%Aucun correctif publié

    CVE-2026-48936

    A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2026-48618

    Élevée · CVSS 7.7EPSS 3,23%Aucun correctif publié

    CVE-2026-48618

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2026-48933

    Élevée · CVSS 7.5EPSS 3,71%Aucun correctif publié

    CVE-2026-48933

    A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  8. CVE-2026-48935

    Faible · CVSS 3.3EPSS 0,18%Aucun correctif publié

    CVE-2026-48935

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2026-48619

    Moyenne · CVSS 5.3EPSS 0,64%Aucun correctif publié

    CVE-2026-48619

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2026-48615

    Moyenne · CVSS 5.9EPSS 0,4%Aucun correctif publié

    CVE-2026-48615

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2026-48931

    Faible · CVSS 3.7EPSS 0,34%Aucun correctif publié

    CVE-2026-48931

    A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-48617

    Faible · CVSS 1.8EPSS 0,32%Aucun correctif publié

    CVE-2026-48617

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →