NodeBB vulnerabilities
We track 8 vulnerabilities in NodeBB products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest NodeBB vulnerabilities
- 7.5 High severity
NodeBB: Authentication Bypass by Spoofing
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the se
- 8.6 High severity
Nodebb: Improper Neutralization of Special Elements used in an SQL Command
NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). The search query parameter is not properly sanitized, allowing unauthenticated, remote attackers to inject boolean-based blind and PostgreSQL error-
- 7.5 High severity
NodeBB: Improper Check for Unusual or Exceptional Conditions
Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventName.toString()`, while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for
- 9.8 Critical severity
Nodebb: XML Injection
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
- 9.8 Critical severity
NodeBB: Improper Limitation of a Pathname to a Restricted Directory
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload c
- 9.8 Critical severity
NodeBB: Improper Initialization
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched
- 7.5 High severity
NodeBB: Cross-Site Request Forgery
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a
- 9.8 Critical severity
NodeBB: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all version