The Node.js Project vulnerabilities

CVEs per yearBy the year they were published

1. 20172
2. 201814

Newest CVEs

• CVE-2018-12123

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is…

  The Node.js Project · Node.js

  Medium4.3
• CVE-2018-12122

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-12121

  Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-12120

  Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or…

  The Node.js Project · Node.js

  High8.1
• CVE-2018-12116

  Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-12115

  In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`,…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-7166

  In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-7167

  Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-7164

  Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from…

  The Node.js Project · Node.js

  High7.5
• CVE-2018-7162

  All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which…

  The Node.js Project · Node.js

  High7.5