Node.js vulnerabilities

A vulnerability in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths, leading to immediate process termination or silent file descriptor leaks that eventually cause denial of service.

A bug has been identified in Node.js error handling where 'Maximum call stack size exceeded' errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications relying on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.

A memory leak in Node.js's OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. Applications calling socket.getPeerCertificate(true) leak memory per certificate field, allowing remote clients to trigger steady memory growth through repeated TLS connections.

Node.js versions 4.0.0, 4.1.0, and 4.1.1 allow remote attackers to cause a denial of service.

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to '..' handling was incompatible with the pathname validation used by unspecified community modules.

Node.js versions from 4.0 to 4.8.3, all 5.x versions, and versions 6.0 to 6.11.0, 7.0 to 7.10.0, and 8.0 to 8.1.3 were susceptible to hash flooding DoS attacks. This was due to the HashTable seed being constant across a given released version of Node.js.

The HTTP header parsing code in Node.js in versions 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header.

Node.js versions 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 are vulnerable to HTTP request smuggling attacks via a crafted Content-Length HTTP header.

Node.js versions 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 do not ensure the availability of a parser for each HTTP socket, allowing remote attackers to cause a denial of service via a pipelined HTTP request.

A flaw in Node.js HTTP request handling causes an uncaught TypeError when a request with a header named __proto__ is received and the application accesses req.headersDistinct. The exception is thrown synchronously inside a property getter and cannot be intercepted by error event listeners.

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. The issue affects users on version v25.

A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files.

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20.

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case "javascript:" (e.g. "javAscript:") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.

All versions of Node.js prior to 6.15.0, 8.14.0, 10.14.0 and 11.3.0 are vulnerable to Slowloris HTTP Denial of Service. An attacker can send headers very slowly, keeping HTTP or HTTPS connections and associated resources alive for a long period of time.

Node.js versions prior to 6.15.0, 8.14.0, 10.14.0, and 11.3.0 are vulnerable to denial of service with large HTTP headers. By combining many requests with maximum-sized headers (almost 80 KB per connection) and carefully timed completion, the HTTP server can abort due to heap allocation failure. Attack potential is mitigated by a load balancer or proxy layer.

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.

Calling Buffer.fill() or Buffer.alloc() with certain parameters can cause a hang, resulting in a Denial of Service. All versions of Node.js 6.x, 8.x, and 9.x are vulnerable; 10.x versions are not.

Node.js versions 9.7.0 and later and 10.x are vulnerable (MEDIUM severity). A bug introduced in 9.7.0 increases memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream.

All versions of Node.js 9.x and 10.x are vulnerable (HIGH severity). An attacker can cause a denial of service (DoS) by crashing a Node.js process providing an HTTP server supporting TLS, by sending duplicate/unexpected messages during the handshake.

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation.

The Node.js inspector in version 6.x and later is vulnerable to a DNS rebinding attack that could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer or another computer with network access to the machine running the Node.js process. A malicious website could use DNS rebinding to bypass same-origin-policy checks and allow HTTP connections to localhost or local network hosts. If a Node.js process with the debug port active is running on localhost or a local network host, the malicious website could connect to it as a debugger and gain full code execution access.

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

A vulnerability in Node.js before versions 4.8.5, 6.11.5, and 8.8.0 allows a remote attacker to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 that makes 8 an invalid value for the windowBits parameter.

Vulnerability in Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from visible IncomingMessage headers while piping the original body to a reused backend connection.

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This affects Node.js 26.x, 24.x, and 22.x.

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation can result in a denial of service. Affects Node.js versions 22.x, 24.x, and 26.x.

A flaw in the Node.js HTTP client can cause request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount`/`maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing, particularly hiding `Content-Length` from userland while the request body is still delivered.

The dns.resolveAny() function in Node.js can abort the process when a DNS response contains more than 256 A records. Repeated triggering can lead to denial of service. Affects Node.js versions 26.x, 24.x, and 22.x.

A vulnerability in Node.js in the node:sqlite module allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements directly using sqlite3_reset(), bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases.

A vulnerability in Node.js HTTP/2 handling allows retained header blocks to bypass maxSessionMemory, potentially leading to remote memory exhaustion. Affects Node.js versions 24.x and 22.x.

Node.js versions 22.x, 24.x, and 26.x have a vulnerability in the Permission Model that allows process.report to write (and overwrite) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary.

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. An attacker with access to one path can abuse boundary handling to read or write paths outside the intended filesystem allowlist. This affects Node.js main, 22.x, 24.x, and 26.x.

An incomplete fix in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies. Affects versions 22.x, 24.x, and 26.x.

A flaw in Node.js HTTPS Agent connection reuse causes PFX object-array key collisions, allowing mTLS client identities to be reused across requests with different client certificates.

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside the --allow-fs-write boundary.

A flaw in Node.js TLS host verification allows an attacker to bypass certificate validation. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js TLS hostname handling causes a mismatch in Unicode dot separator normalization between the resolver and verifier, leading to a wildcard-depth authentication bypass. This can result in confidentiality impact or bypass of the intended security boundary.

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is sent before the client has sent the request. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls JSON.parse() on attacker-controlled input. This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model.

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model.

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values. This vulnerability affects 20.x, 22.x, 24.x, and 25.x.

A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them. As a result, code running under --permission without --allow-net can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary. This vulnerability affects Node.js 25.x processes using the Permission Model where --allow-net is intentionally omitted to restrict network access. Note that --allow-net is currently an experimental feature.

A flaw in Node.js URL processing causes an assertion failure in native code when url.format() is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service.