p PatchFirst

PatchFirst · Latest vulnerabilities

node.js 26.3.0: known vulnerabilities

Known vulnerabilities affecting node.js 26.3.0: 12. Compare the fixes below with your installed release.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 12

  1. CVE-2026-48932

    Low · CVSS 3.7EPSS 0.27%No fix published

    CVE-2026-48932

    A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, a

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-48930

    Medium · CVSS 5.6EPSS 0.32%No fix published

    CVE-2026-48930

    A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-48928

    Medium · CVSS 4.2EPSS 0.22%No fix published

    CVE-2026-48928

    A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-48934

    Medium · CVSS 4.3EPSS 0.26%No fix published

    CVE-2026-48934

    A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-48936

    Low · CVSS 3.3EPSS 0.14%No fix published

    CVE-2026-48936

    A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission. This vulnerability affects one supported release line: **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-48618

    High · CVSS 7.7EPSS 3.23%No fix published

    CVE-2026-48618

    A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  8. CVE-2026-48935

    Low · CVSS 3.3EPSS 0.18%No fix published

    CVE-2026-48935

    A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-48619

    Medium · CVSS 5.3EPSS 0.64%No fix published

    CVE-2026-48619

    A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-48615

    Medium · CVSS 5.9EPSS 0.4%No fix published

    CVE-2026-48615

    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-48617

    Low · CVSS 1.8EPSS 0.32%No fix published

    CVE-2026-48617

    A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

    node.jsNode.js
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →