# Node.

Every CVE that names Node among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Command injection in Node](https://agentprime.io/advisories/CVE-2024-36138.md)
  `CVE-2024-36138` · CVE record: NodeJS Node · CVSS 8.1 High · Not analysed yet · Published 7 Sept 2024 · Tags: Command injection
- [Code injection in Node](https://agentprime.io/advisories/CVE-2023-39333.md)
  `CVE-2023-39333` · CVE record: NodeJS Node · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2024 · Tags: Code injection
- [Node: A vulnerability has been identified in Node.js…](https://agentprime.io/advisories/CVE-2024-36137.md)
  `CVE-2024-36137` · CVE record: NodeJS Node · CVSS 3.3 Low · Not analysed yet · Published 7 Sept 2024
- [Improper access control in Node](https://agentprime.io/advisories/CVE-2023-30582.md)
  `CVE-2023-30582` · CVE record: NodeJS Node · CVSS 5.3 Medium · Not analysed yet · Published 7 Sept 2024 · Tags: Broken access control
- [Improper access control in Node](https://agentprime.io/advisories/CVE-2023-30587.md)
  `CVE-2023-30587` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2024 · Tags: Broken access control
- [Improper access control in Node](https://agentprime.io/advisories/CVE-2023-30583.md)
  `CVE-2023-30583` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2024 · Tags: Broken access control
- [Path traversal in Node](https://agentprime.io/advisories/CVE-2023-30584.md)
  `CVE-2023-30584` · CVE record: NodeJS Node · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2024 · Tags: Path traversal
- [Node: A vulnerability has been identified in Node.js…](https://agentprime.io/advisories/CVE-2024-22018.md)
  `CVE-2024-22018` · CVE record: NodeJS Node · CVSS 2.9 Low · Not analysed yet · Published 10 Jul 2024
- [Code injection in Node](https://agentprime.io/advisories/CVE-2024-22020.md)
  `CVE-2024-22020` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Code injection
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2024-27982.md)
  `CVE-2024-27982` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2024 · Tags: HTTP request smuggling
- [Race condition in Node](https://agentprime.io/advisories/CVE-2024-27983.md)
  `CVE-2024-27983` · CVE record: NodeJS Node · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.87 · Not analysed yet · Published 9 Apr 2024 · Tags: Race condition
- [Improper resource shutdown in Node](https://agentprime.io/advisories/CVE-2024-22025.md)
  `CVE-2024-22025` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: Denial of service
- [Execution with unnecessary privileges in Node](https://agentprime.io/advisories/CVE-2024-22017.md)
  `CVE-2024-22017` · CVE record: NodeJS Node · CVSS 7.3 High · Not analysed yet · Published 19 Mar 2024 · Tags: Privilege escalation
- [Node: The permission model protects itself against path traversal attacks by calling…](https://agentprime.io/advisories/CVE-2024-21896.md)
  `CVE-2024-21896` · CVE record: NodeJS Node · CVSS 7.9 High · Not analysed yet · Published 20 Feb 2024 · Tags: CWE-27
- [Node: The Node.js Permission Model does not clarify in the documentation that wildcards should…](https://agentprime.io/advisories/CVE-2024-21890.md)
  `CVE-2024-21890` · CVE record: NodeJS Node · CVSS 5.0 Medium · Not analysed yet · Published 20 Feb 2024
- [Path traversal in Node](https://agentprime.io/advisories/CVE-2024-21891.md)
  `CVE-2024-21891` · CVE record: NodeJS Node · CVSS 7.9 High · Not analysed yet · Published 20 Feb 2024 · Tags: Path traversal
- [Improper resource shutdown in Node](https://agentprime.io/advisories/CVE-2024-22019.md)
  `CVE-2024-22019` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2024 · Tags: Denial of service
- [Improper privilege management in Node](https://agentprime.io/advisories/CVE-2024-21892.md)
  `CVE-2024-21892` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2024 · Tags: Privilege escalation
- [The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the functi…](https://agentprime.io/advisories/CVE-2023-30590.md)
  `CVE-2023-30590` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 28 Nov 2023
- [Node: When an invalid public key is used to create an x509 certificate using the…](https://agentprime.io/advisories/CVE-2023-30588.md)
  `CVE-2023-30588` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 28 Nov 2023
- [Node: A vulnerability has been identified in the Node.js (.msi version) installation process…](https://agentprime.io/advisories/CVE-2023-30585.md)
  `CVE-2023-30585` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 28 Nov 2023
- [Missing authorization in Node](https://agentprime.io/advisories/CVE-2023-30581.md)
  `CVE-2023-30581` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 22 Nov 2023 · Tags: Broken access control
- [A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.](https://agentprime.io/advisories/CVE-2023-39331.md)
  `CVE-2023-39331` · CVE record: NodeJS Node · CVSS 7.7 High · Not analysed yet · Published 18 Oct 2023
- [Node: When the Node.js policy feature checks the integrity of a resource against a trusted…](https://agentprime.io/advisories/CVE-2023-38552.md)
  `CVE-2023-38552` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 18 Oct 2023
- [Various \`node:fs\` functions allow specifying paths as either strings or \`Uint8Array\` objects.](https://agentprime.io/advisories/CVE-2023-39332.md)
  `CVE-2023-39332` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 18 Oct 2023
- [Node: The use of the deprecated API \`process.binding()\` can bypass the permission model through…](https://agentprime.io/advisories/CVE-2023-32558.md)
  `CVE-2023-32558` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 12 Sept 2023
- [Incorrect permission assignment in Node](https://agentprime.io/advisories/CVE-2023-32005.md)
  `CVE-2023-32005` · CVE record: NodeJS Node · CVSS 5.3 Medium · Not analysed yet · Published 12 Sept 2023 · Tags: Broken access control
- [Improper privilege management in Node](https://agentprime.io/advisories/CVE-2023-32559.md)
  `CVE-2023-32559` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 24 Aug 2023 · Tags: Privilege escalation
- [Authentication bypass in Node](https://agentprime.io/advisories/CVE-2023-32002.md)
  `CVE-2023-32002` · CVE record: NodeJS Node · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2023 · Tags: Authentication bypass
- [Path traversal in Node](https://agentprime.io/advisories/CVE-2023-32003.md)
  `CVE-2023-32003` · CVE record: NodeJS Node · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2023 · Tags: Path traversal
- [Path traversal in Node](https://agentprime.io/advisories/CVE-2023-32004.md)
  `CVE-2023-32004` · CVE record: NodeJS Node · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2023 · Tags: Path traversal
- [Protection mechanism failure in Node](https://agentprime.io/advisories/CVE-2023-32006.md)
  `CVE-2023-32006` · CVE record: NodeJS Node · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2023 · Tags: CWE-693
- [Missing authorization in Node](https://agentprime.io/advisories/CVE-2023-30586.md)
  `CVE-2023-30586` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 30 Jun 2023 · Tags: Broken access control
- [Untrusted search path in Node](https://agentprime.io/advisories/CVE-2023-23920.md)
  `CVE-2023-23920` · CVE record: NodeJS Node · CVSS 4.2 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: CWE-426
- [Node: A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1…](https://agentprime.io/advisories/CVE-2023-23919.md)
  `CVE-2023-23919` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 23 Feb 2023 · Tags: CWE-310
- [Incorrect authorization in Node](https://agentprime.io/advisories/CVE-2023-23918.md)
  `CVE-2023-23918` · CVE record: NodeJS Node · CVSS 7.5 High · Not analysed yet · Published 23 Feb 2023 · Tags: Broken access control
- [OS command injection in Node](https://agentprime.io/advisories/CVE-2022-43548.md)
  `CVE-2022-43548` · CVE record: NodeJS Node · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 5 Dec 2022 · Tags: Command injection
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2022-35256.md)
  `CVE-2022-35256` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 5 Dec 2022 · Tags: HTTP request smuggling
- [Weak random number generator in Node](https://agentprime.io/advisories/CVE-2022-35255.md)
  `CVE-2022-35255` · CVE record: NodeJS Node · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2022 · Tags: Weak cryptography or TLS
- [Uncontrolled search path in Node](https://agentprime.io/advisories/CVE-2022-32223.md)
  `CVE-2022-32223` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 14 Jul 2022 · Tags: CWE-427
- [Node: A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to…](https://agentprime.io/advisories/CVE-2022-32222.md)
  `CVE-2022-32222` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 14 Jul 2022 · Tags: CWE-310
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2022-32215.md)
  `CVE-2022-32215` · CVE record: NodeJS Node · No CVSS score · EPSS 0.70 · Not analysed yet · Published 14 Jul 2022 · Tags: HTTP request smuggling
- [Improper access control in Node](https://agentprime.io/advisories/CVE-2022-32212.md)
  `CVE-2022-32212` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 14 Jul 2022 · Tags: Broken access control
- [Improper certificate validation in Node](https://agentprime.io/advisories/CVE-2021-44533.md)
  `CVE-2021-44533` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 24 Feb 2022 · Tags: Weak cryptography or TLS
- [Node: Node.js < 12.22.9, < 14.18.3, < 16.13.2…](https://agentprime.io/advisories/CVE-2021-44532.md)
  `CVE-2021-44532` · CVE record: NodeJS Node · No CVSS score · EPSS 0.10 · Not analysed yet · Published 24 Feb 2022 · Tags: CWE-296
- [Improper certificate validation in Node](https://agentprime.io/advisories/CVE-2021-44531.md)
  `CVE-2021-44531` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 24 Feb 2022 · Tags: Weak cryptography or TLS
- [Node: Due to the formatting logic of the "console.table()" function it was not safe to allow…](https://agentprime.io/advisories/CVE-2022-21824.md)
  `CVE-2022-21824` · CVE record: NodeJS Node · No CVSS score · EPSS 0.22 · Not analysed yet · Published 24 Feb 2022 · Tags: CWE-471
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2021-22959.md)
  `CVE-2021-22959` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 15 Nov 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2021-22960.md)
  `CVE-2021-22960` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: HTTP request smuggling
- [Use after free in Node](https://agentprime.io/advisories/CVE-2021-22930.md)
  `CVE-2021-22930` · CVE record: NodeJS Node · No CVSS score · EPSS 0.36 · Not analysed yet · Published 7 Oct 2021 · Tags: Memory corruption
- [Use after free in Node](https://agentprime.io/advisories/CVE-2021-22940.md)
  `CVE-2021-22940` · CVE record: NodeJS Node · No CVSS score · EPSS 0.14 · Not analysed yet · Published 16 Aug 2021 · Tags: Memory corruption
- [Improper certificate validation in Node](https://agentprime.io/advisories/CVE-2021-22939.md)
  `CVE-2021-22939` · CVE record: NodeJS Node · No CVSS score · EPSS 0.15 · Not analysed yet · Published 16 Aug 2021 · Tags: Weak cryptography or TLS
- [Improper null termination in Node](https://agentprime.io/advisories/CVE-2021-22931.md)
  `CVE-2021-22931` · CVE record: NodeJS Node · No CVSS score · EPSS 0.22 · Not analysed yet · Published 16 Aug 2021 · Tags: CWE-170
- [Incorrect permission assignment in Node](https://agentprime.io/advisories/CVE-2021-22921.md)
  `CVE-2021-22921` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 12 Jul 2021 · Tags: Broken access control
- [Out-of-bounds read in Node](https://agentprime.io/advisories/CVE-2021-22918.md)
  `CVE-2021-22918` · CVE record: NodeJS Node · No CVSS score · EPSS 0.23 · Not analysed yet · Published 12 Jul 2021 · Tags: Memory corruption
- [Uncontrolled resource consumption in Node](https://agentprime.io/advisories/CVE-2021-22883.md)
  `CVE-2021-22883` · CVE record: NodeJS Node · No CVSS score · EPSS 0.77 · Not analysed yet · Published 3 Mar 2021 · Tags: Denial of service
- [Node: Node.js before 10.24.0, 12.21.0, 14.16.0…](https://agentprime.io/advisories/CVE-2021-22884.md)
  `CVE-2021-22884` · CVE record: NodeJS Node · No CVSS score · EPSS 0.37 · Not analysed yet · Published 3 Mar 2021 · Tags: CWE-350
- [Use after free in Node](https://agentprime.io/advisories/CVE-2020-8265.md)
  `CVE-2020-8265` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 6 Jan 2021 · Tags: Memory corruption
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2020-8287.md)
  `CVE-2020-8287` · CVE record: NodeJS Node · No CVSS score · EPSS 0.16 · Not analysed yet · Published 6 Jan 2021 · Tags: HTTP request smuggling
- [Uncontrolled resource consumption in Node](https://agentprime.io/advisories/CVE-2020-8277.md)
  `CVE-2020-8277` · CVE record: NodeJS Node · No CVSS score · EPSS 0.54 · Not analysed yet · Published 19 Nov 2020 · Tags: Denial of service

Newest: <https://agentprime.io/advisories/technology/node.md>
Older: <https://agentprime.io/advisories/technology/node.md?cursor=WyIyMDIwLTExLTE5VDAwOjMyOjEzLjAwMDAwMFoiLCJDVkUtMjAyMC04Mjc3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=node&cursor=WyIyMDI0LTA5LTA3VDE2OjAzOjMyLjk5NjAwMFoiLCJDVkUtMjAyMy00NjgwOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/node/?cursor=WyIyMDI0LTA5LTA3VDE2OjAzOjMyLjk5NjAwMFoiLCJDVkUtMjAyMy00NjgwOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.