CyberSecBulletin

Node.js vulnerabilities

We track 2 vulnerabilities in Node.js products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 10, 2024.

2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score

Latest Node.js vulnerabilities

  • 9.8 Critical severity

    Node.js: Improper Neutralization of Special Elements used in a Command

    CVE-2024-3566Node.jsEPSS 6.83%

    A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

  • 7.5 High severity

    Node: Improper Resource Shutdown or Release

    CVE-2024-22019Node.jsEPSS 3.17%

    A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, explo