See how openjs compares to other vendors in security performance
A flaw in Node.js Permission Model enforcement allows traceevents.createTracing().enable() Writes Trace Logs Outside --allow-fs-write.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
This vulnerability affects Node.js 22.x, 24.x, and 26.x.
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under --permission, an attacker who is granted access to one path can abuse radix-tree prefix boundary handling to read from or write to paths outside the intended filesystem allowlist.
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.
A flaw in Node.js Permission Model enforcement allows process.report to write and overwrite files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
This vulnerability affects Node.js 24.x and 22.x.
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.