NodeBB vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20213
3. 20223
4. 20232
5. 20264

Newest CVEs

• CVE-2026-120007

  NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid

  NodeBB · NodeBB

  Medium6.9
• CVE-2026-73038

  NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name

  NodeBB · NodeBB

  Medium5.3
• CVE-2026-58593

  NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User

  NodeBB · NodeBB

  High8.7
• CVE-2021-47746

  NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write

  NodeBB · NodeBB Plugin Emoji

  High8.6
• CVE-2023-2850

  NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows…

  NodeBB · NodeBB

  Medium4.7
• CVE-2023-26045

  NodeBB vulnerable to path traversal and code execution via prototype vulnerability

  NodeBB · NodeBB

  Critical10.0
• CVE-2022-46164

  Account takeover via prototype vulnerability

  NodeBB · NodeBB

  Critical9.4
• CVE-2022-36076

  Account takeover via SSO plugins in NodeBB

  NodeBB · NodeBB

  High8.8
• CVE-2022-36045

  Account takeover via cryptographically weak PRNG in NodeBB Forum

  NodeBB · NodeBB

  Critical9.0
• CVE-2021-43788

  Path traversal in translator module of NobeBB

  NodeBB · NodeBB

  Medium5.0