Node.js known exploited vulnerabilities
The Beam CVE database tracks 10 known exploited vulnerabilities for Node.js: 4 high, 3 medium and 3 low severity. The newest is CVE-2026-105481, published Oct 21, 2026.
These are the Node.js vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: flaws with confirmed exploitation in the wild. Each entry links the vendor bulletin and CISA’s required action.
- Vulnerabilities tracked
- 10
- Critical
- 0
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 10
All entries, newest first
CVE-2026-105481
Node.js keep-alive socket processes a response that was written before the request was sent
mediumOct 21, 2026CVE-2026-105482
Node.js dns.resolve truncates names containing NUL char
highOct 21, 2026CVE-2026-105483
Node.js TLS certificate hostname bypass when the IP is written fullwidth digits
highOct 21, 2026CVE-2026-106069
Node.js TLS certificate hostname bypass when the host loosely resolves to an IP address
highOct 21, 2026CVE-2026-106070
Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation
lowOct 21, 2026CVE-2026-106071
Node.js Permission Model filesystem over-grant via wildcard radix lookup
lowOct 21, 2026CVE-2026-106072
Node.js improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints
mediumOct 21, 2026CVE-2026-106073
Node.js Permission Model bypass with fs.realpathSync
lowOct 21, 2026CVE-2026-106074
Node.js crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs
mediumOct 21, 2026CVE-2026-111497
Node.js Brotli decoder out-of-bounds write permits remote code execution
highOct 21, 2026