diff --git a/.github/workflows/generate-vex.yml b/.github/workflows/generate-vex.yml new file mode 100644 index 000000000..e2a615d7e --- /dev/null +++ b/.github/workflows/generate-vex.yml @@ -0,0 +1,78 @@ +name: "Generate VEX document" + +on: + workflow_run: + workflows: + - "Update core index.json" + - "Update deps index.json" + - "Update npm index.json" + types: + - completed + workflow_dispatch: + push: + branches: + - main + paths: + - 'vuln/core/index.json' + - 'vuln/npm/index.json' + - 'vuln/deps/index.json' + - 'tools/vex/**' + +concurrency: + group: generate-vex + cancel-in-progress: true + +permissions: + contents: write + pull-requests: write + +jobs: + generate-vex: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + + - name: Checkout repository + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + with: + persist-credentials: false + + - name: Setup Go + uses: actions/setup-go@v5 + with: + go-version: '1.23.x' + + - name: Generate VEX document + working-directory: tools/vex + run: | + go run . + + - name: Detect changes + id: detect + run: | + if git diff --quiet node.openvex.json; then + echo "no_changes=true" >> $GITHUB_OUTPUT + else + echo "no_changes=false" >> $GITHUB_OUTPUT + fi + + - name: Create Pull Request + if: steps.detect.outputs.no_changes == 'false' + uses: gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + commit-message: 'vex: regenerate node.openvex.json' + title: regenerate node.openvex.json + body: 'Automated regeneration of node.openvex.json after vulnerability index update. cc: @nodejs/security-wg' + assignees: ${{ github.actor }} + labels: security-wg-agenda + branch: regenerate-vex + update-pull-request-title-and-body: true + + - name: No changes summary + if: steps.detect.outputs.no_changes == 'true' + run: echo "No changes to node.openvex.json; skipping PR creation." diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index b1bbff44b..cf4feb2d7 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -23,6 +23,6 @@ jobs: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: 'This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.' stale-issue-label: 'stale' - exempt-issue-label: 'never-stale' + exempt-issue-labels: 'never-stale' days-before-stale: 90 days-before-close: 14 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 4be8864ac..f11b31dd8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -15,7 +15,7 @@ jobs: strategy: fail-fast: false matrix: - node-version: [18.x, 20.x, 22.x] + node-version: [20.x, 22.x, '24.x'] os: [ubuntu-latest] runs-on: ${{ matrix.os }} steps: diff --git a/.github/workflows/update-core-index.yml b/.github/workflows/update-core-index.yml index 21f238913..4613cc72e 100644 --- a/.github/workflows/update-core-index.yml +++ b/.github/workflows/update-core-index.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: - node-version: 18 + node-version-file: '.nvmrc' - name: Install deps run: npm ci diff --git a/.github/workflows/update-deps-index.yml b/.github/workflows/update-deps-index.yml new file mode 100644 index 000000000..e0116ea9b --- /dev/null +++ b/.github/workflows/update-deps-index.yml @@ -0,0 +1,50 @@ +name: "Update deps index.json" +on: + workflow_dispatch: + push: + branches: + - main + paths: + - 'vuln/deps/*.json' + - '!vuln/deps/index.json' + +permissions: + contents: write + pull-requests: write + +jobs: + stale: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + with: + persist-credentials: false + + - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 + with: + node-version-file: '.nvmrc' + + - name: Install deps + run: npm ci + + - name: Update deps index.json + run: | + npm run create-deps-index + + - name: Create Pull Request + uses: gr2m/create-or-update-pull-request-action@77596e3166f328b24613f7082ab30bf2d93079d5 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + commit-message: 'vuln: update deps index.json' + title: update deps index.json + body: 'update deps index.json. cc: @nodejs/security-wg' + assignees: ${{ github.actor }} + labels: security-wg-agenda + branch: deps-index-updated + update-pull-request-title-and-body: true diff --git a/.github/workflows/update-npm-index.yml b/.github/workflows/update-npm-index.yml index 6a3ea2cb0..625f29e44 100644 --- a/.github/workflows/update-npm-index.yml +++ b/.github/workflows/update-npm-index.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: - node-version: 18 + node-version-file: '.nvmrc' - name: Install deps run: npm ci diff --git a/.github/workflows/validate-vulnerability.yml b/.github/workflows/validate-vulnerability.yml index e5f044d7e..1a363bbb0 100644 --- a/.github/workflows/validate-vulnerability.yml +++ b/.github/workflows/validate-vulnerability.yml @@ -24,7 +24,7 @@ jobs: - name: Use Node.js uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: - node-version: 18 + node-version-file: '.nvmrc' - name: Install deps run: npm ci diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 000000000..2bd5a0a98 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +22 diff --git a/INCIDENT_RESPONSE_PLAN.md b/INCIDENT_RESPONSE_PLAN.md new file mode 100644 index 000000000..e718e7684 --- /dev/null +++ b/INCIDENT_RESPONSE_PLAN.md @@ -0,0 +1,133 @@ +# Node.js Security Incident Response Plan + +This document outlines the procedures to follow when responding to +security incidents affecting the Node.js project. + +It is intended for Node.js maintainers and security team members who +need to respond to various types of security incidents. + +## Table of Contents + +1. [Security Incident Types](#security-incident-types) +2. [Incident Response Team](#incident-response-team) +3. [Incident Response Procedures](#incident-response-procedures) + - [Premature Disclosure](#premature-disclosure) + - [Zero-Day Vulnerability](#zero-day-vulnerability) + - [Dependency Vulnerability](#dependency-vulnerability) + - [Embargo Violation](#embargo-violation) +4. [Communication Channels](#communication-channels) +5. [Post-Incident Analysis](#post-incident-analysis) + +## Security Incident Types + +Security incidents affecting Node.js may include, but are not limited to: + +- **Premature Disclosure**: When a vulnerability is publicly disclosed before a patch is available +- **Zero-Day Vulnerability**: A previously unknown vulnerability that is being actively exploited +- **Dependency Vulnerability**: Critical vulnerabilities in Node.js dependencies +- **Embargo Violation**: When confidential vulnerability information is shared before the agreed embargo date + +## Incident Response Team + +The Node.js incident response team includes: + +- [Technical Steering Committee (TSC) members](https://github.com/nodejs/tsc) +- [Security Release](https://github.com/orgs/nodejs/teams/security-release) +- [Security Release Stewards](https://github.com/orgs/nodejs/teams/security-stewards) + +## Incident Response Procedures + +### Premature Disclosure + +When a security vulnerability is prematurely disclosed before a patch is ready: + +1. **Immediate Action**: + - Transfer the issue to the private [`premature-disclosures`](https://github.com/nodejs/premature-disclosures) repository + - Immediately inform `tsc@nodejs.org` + +2. **Assessment**: + - Security team evaluates the severity and exploitability + - Determine if an emergency release is required + +3. **Response**: + - Prioritize developing a fix for the vulnerability + - Prepare a security advisory draft + - Schedule an accelerated release timeline + +### Zero-Day Vulnerability + +When a potential zero-day vulnerability is discovered: + +1. **Immediate Action**: + - Contact `tsc@nodejs.org` immediately + - Invite relevant members to a new private channel on OpenJS Foundation Slack + - Mark all communications as confidential + +2. **Containment**: + - Identify the scope of the vulnerability + - Determine if temporary mitigation measures are possible + - Assess active exploitation in the wild + +3. **Resolution**: + - Assemble an emergency response team to develop a fix + - Prepare for an out-of-band security release + - Create a detailed timeline for fix development, testing, and release + +### Dependency Vulnerability + +When a critical vulnerability affects a Node.js dependency: + +1. **Assessment**: + - Determine if the vulnerability impacts Node.js users + - Evaluate if the vulnerable dependency code path is reachable + +2. **Coordination**: + - Contact the dependency maintainers via private channels + - Coordinate disclosure timeline and fix development + - Consider preparing a Node.js-specific patch if necessary + +3. **Response**: + - Plan for version updates or backports as needed + - Include fixes in the next appropriate release + +### Embargo Violation + +When confidential vulnerability information is shared before an agreed embargo date: + +1. **Verification**: + - Confirm that an embargo violation has occurred + - Assess the extent of the information leaked + +2. **Notification**: + - Inform all parties involved in the original disclosure + - Contact `tsc@nodejs.org` immediately + +3. **Acceleration**: + - Consider accelerating the release schedule + - Update communication plans accordingly + +## Communication Channels + +During security incidents, use the following communication channels: + +- **Private**: OpenJS Foundation Slack private channels +- **Semi-private**: HackerOne for coordinating with reporters +- **Private Repositories**: GitHub private repositories for fix development +- **Email**: `security@nodejs.org` and `tsc@nodejs.org` for official communications +- **Public**: The Node.js blog and social media for public announcements (post-fix) + +## Post-Incident Analysis + +After resolving a security incident: + +1. **Documentation**: + - Document the incident timeline + - Record lessons learned and response effectiveness + +2. **Process Improvement**: + - Identify process gaps and improvement opportunities + - Update this incident response plan as needed + +3. **Follow-up**: + - Conduct a blameless post-mortem with the response team + - Implement improvements to prevent similar incidents diff --git a/README.md b/README.md index 54576b49e..ccd7d6c48 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,7 @@ The program is managed through the HackerOne platform at [https://hackerone.com/ | Automate Security release process | [@marco-ippolito](https://github.com/marco-ippolito) / [@RafaelGSS](https://github.com/RafaelGSS) | In Progress | [Issue #860](https://github.com/nodejs/security-wg/issues/860) | Node.js maintainers: Threat Model | Group effort | In Progress | [Issue #1333](https://github.com/nodejs/security-wg/issues/1333) | | Audit build process for dependencies | [@mhdawson](https://github.com/mhdawson) | TODO | [Issue #1037](https://github.com/nodejs/security-wg/issues/1037) | +| Adopt OpenJS CNA for CVE Operations | [@UlisesGascon](https://github.com/UlisesGascon) | In progress | [Issue #1576](https://github.com/nodejs/security-wg/issues/1576) | ## Current Project Team Members diff --git a/meetings/2025-06-11.md b/meetings/2025-06-11.md new file mode 100644 index 000000000..393c7352d --- /dev/null +++ b/meetings/2025-06-11.md @@ -0,0 +1,65 @@ +# Node.js Security team Meeting 2025-11-06 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=a7zV2sdSTEU +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1530 +* **Minutes**: https://hackmd.io/@openjs-nodejs/HyClNtW1Ze + +## Present + +* Security wg team: @nodejs/security-wg +* Rafael Gonzaga: @RafaelGSS +* Ulises Gascón: @ulisesGascon +* Marco Ippolito: @marco-ippolito +* Wes Todd: @wesleytodd + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues + - We have reviewed the https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/213 and we don't believe those CVEs affects Node.js +- [X] OpenSSF Scorecard Monitor Review - https://github.com/nodejs/security-wg/pull/1532 + - No meaningful updates + - Good improvement on CITGM - Updated dependencies. + +### nodejs/security-wg + +- Reduce meeting frequency to monthly [#1527](https://github.com/nodejs/security-wg/issues/1527) + - Active discussions are happening on OpenJS Security Collab Space + +* Create a VEX file for Node.js [#1517](https://github.com/nodejs/security-wg/issues/1517) + - +1 from the team + - Marco will create a PR to move forward with this initiative + +### nodejs/node + +* Auditing permissions [#59935](https://github.com/nodejs/node/issues/59935) + - Draft PR has been created + - Rafael, currently the feature is emitting a warning to the console, but I don't think this is good. It would be much better to send the warning through a place where users can consume, like diagnostics_channel, however, there's no native implementation of dc yet, so we'll need to create one from scratch. Non-trivial work. + +* src: add WDAC integration (Windows) [#54364](https://github.com/nodejs/node/pull/54364) + - TOCTOU issues + - Removed from the agenda as its stale + +## Q&A, Other + +- OpenJS Blog Post - Publishing Packages via CI + - We have set up https://github.com/npm-pub-2025 + - We need to consolitate step 2 and step 3 into just one + - https://expressjs/ci-workflows + - Proposal to have this action available for users to re-use + - We'll compare our strategy with npm recent changes + - Package Maintenance Working Group will set up a meeting to work technically on these actions - https://github.com/nodejs/package-maintenance + - Next actions: Schedule the meeting, + - Propose the action to the pkgjs organization, + - Reduce the GOVERNANCE from pkgjs to handle small groups of maintainers - e.g 1 - 2 approvals for PRs + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `Add to Google Calendar` at the bottom left to add to your own Google calendar. diff --git a/meetings/2025-07-17.md b/meetings/2025-07-17.md new file mode 100644 index 000000000..239fb2112 --- /dev/null +++ b/meetings/2025-07-17.md @@ -0,0 +1,66 @@ +# Node.js Security team Meeting 2025-07-17 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=_YmVz6tyYFc&ab_channel=node.js +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1494 +* **Minutes Google Doc**: https://docs.google.com/document/d/10DElWFkWGjavqCk5HsRZXZWsAiKCaYz0RFMWAzStuWk/edit?tab=t.0 + +## Present + +* Security team: @nodejs/security-wg +* Marco Ippolito: @marco-ippolito +* Ulises Gascón: @UlisesGascon +* Robert Waite +* Rafael Gonzaga: @RafaelGSS + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues +- [X] OpenSSF Scorecard Monitor Review + - No action pending from our side: https://github.com/nodejs/security-wg/pull/1498 + +### nodejs/node + +* doc: add constraints for mem leak to threat model #58917 + * We briefly discussed it + * Task to review that async + +* src: add WDAC integration (Windows) #54364 + * Robert is working on a TOCTOU patch + * Robert also provided instructions on how to sign and use this feature on a Windows machine + * Rafael will run it locally once the last patch is concluded + +### nodejs/security-wg + +* Wrong CVE Creation - May 14th Security Releases #1483 + * Identified the same bug in the last security release (July 15) + * Rafael is in contact with H1 to fix it + +* Update on CVEs for EOL Release Lines – MITRE Removal & Next Steps #1443 + * Still pending the update of old CVEs to include EOL lines + +* Review Code Scanning Alerts #1453 + * The remaining alerts are points to tools/ or test/ + * There’s nothing to worry about + * Rafael will take the action to review that carefully before removing it from the agenda + +* Node.js maintainers: Threat Model #1333 + * Plan to finalise the document in the next session + * We’ll show it in the next security collab space (openjs foundation) + * Decide in the next session if the work is “concluded” + +* Audit build process for dependencies [#1037](https://github.com/nodejs/security-wg/issues/1037) + +## Q&A, Other + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. + diff --git a/meetings/2025-09-11.md b/meetings/2025-09-11.md new file mode 100644 index 000000000..f73efcb29 --- /dev/null +++ b/meetings/2025-09-11.md @@ -0,0 +1,57 @@ +# Node.js Security team Meeting 2025-09-11 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=2_exLrhF5YM&ab_channel=node.js +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1518 +* **Minutes Google Doc**: https://docs.google.com/document/d/1zPUOHww6WD9VtLoTeoMaPuoWeHi6_6uujHcVNG1SeF0/edit?tab=t.0 + +## Present + +* Security wg team: @nodejs/security-wg + +* Ulises Gascón: @UlisesGascon +* Rafael Gonzaga: @RafaelGSS + +## Agenda + +## Announcements +* A targeted campaign has emerged against npm package maintainers, where attackers are leveraging stolen authentication tokens to impersonate maintainers and publish malicious package versions: https://jfrog.com/blog/new-compromised-packages-in-largest-npm-attack-in-history/ + + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- [X] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues +- [X] OpenSSF Scorecard Monitor Review + - No Action needed from our team. Last PR can be merged: https://github.com/nodejs/security-wg/pull/1520 + +### nodejs/node + +* src: add WDAC integration (Windows) #54364 + * No updates + +* Option to enable inspection mode along with permission model #48534 + * Rafael opened a PR to add –allow-inspector https://github.com/nodejs/node/pull/59711 + * Seems ready to go + +### nodejs/security-wg + +* Create a VEX file for Node.js #1517 + * Leaving that open for further discussion with Marco + +* Update on CVEs for EOL Release Lines – MITRE Removal & Next Steps #1443 + * Closing as completed + +* Node.js maintainers: Threat Model #1333 + * Closing as completed + +## Q&A, Other + +https://github.com/nodejs/node/pull/59806 + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `+GoogleCalendar` at the bottom right to add to your own Google calendar. + diff --git a/meetings/2026-03-19.md b/meetings/2026-03-19.md new file mode 100644 index 000000000..ce3fa7ad3 --- /dev/null +++ b/meetings/2026-03-19.md @@ -0,0 +1,65 @@ +# Node.js Security team Meeting 2026-03-19 + +## Links + +* **Recording**: https://www.youtube.com/watch?v=7XV5ra3A5-I +* **GitHub Issue**: https://github.com/nodejs/security-wg/issues/1555 +* **Minutes**: https://hackmd.io/@openjs-nodejs/rkHBMRRl5-x + +## Present + +* Security wg team: @nodejs/security-wg +* Rafael Gonzaga: @RafaelGSS +* Marco Ippolito: @marco-ippolito +* Beth Griggs: @BethGriggs + +## Agenda + +## Announcements + +*Extracted from **security-wg-agenda** labelled issues and pull requests from the **nodejs org** prior to the meeting. + +- Node.js Security release announced to March 24th +- [x] Vulnerability Review - https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues + - VEX file has been published + - There are more work to do. +- [ ] OpenSSF Scorecard Monitor Review - https://github.com/nodejs/security-wg/issues?q=is%3Aissue+OpenSSF+Scorecard+Report+Updated%21+ + +### nodejs/security-wg + +* Node.js PURL is missing namespace [#1552](https://github.com/nodejs/security-wg/issues/1552) + * PURL = Package URL + * It needs to be fixed. It's missing the protocol (should be generic + * The ecosystem refers to Node.js as `node` while the project itself refers to `nodejs/node`. + * Proposal to use `nodejs/node` as preference in the VEX file + +* regenerate node.openvex.json [#1549](https://github.com/nodejs/security-wg/pull/1549) + * Remove from the agenda. + +* update deps index.json [#1547](https://github.com/nodejs/security-wg/pull/1547) + * Approved and merged. + +* Tracking: LLM-assisted H1 report triage [#1554](https://github.com/nodejs/security-wg/issues/1554) + * Beth is working on a model to classify open reports based on + * All closed reports + * SECURITY.md + * Next: Node.js documentation + +### nodejs/TSC + +* Proposal: Moving security reports to a public workflow [#1826](https://github.com/nodejs/TSC/issues/1826) + * We are going to discuss it in depth in the collaborator summit + * An intermediary proposal is to avoid CI embargo. Under discussion with releasers team. + +### nodejs/node + +* Auditing permissions [#59935](https://github.com/nodejs/node/issues/59935) + * Concluded by https://github.com/nodejs/node/commit/9ddd1a9c27c253f46d587a8c906ccd83417b4606. + +## Q&A, Other + +## Upcoming Meetings + +* **Node.js Project Calendar**: + +Click `Add to Google Calendar` at the bottom left to add to your own Google calendar. diff --git a/package.json b/package.json index 804471099..e54daf102 100644 --- a/package.json +++ b/package.json @@ -5,7 +5,8 @@ "test": "node --test", "validate": "node tools/vuln_valid", "create-npm-index": "node tools/create_index/create_npm_index.js", - "create-core-index": "node tools/create_index/create_core_index.js" + "create-core-index": "node tools/create_index/create_core_index.js", + "create-deps-index": "node tools/create_index/create_deps_index.js" }, "keywords": [], "author": "", diff --git a/tools/create_index/create_deps_index.js b/tools/create_index/create_deps_index.js new file mode 100644 index 000000000..23f5b9f77 --- /dev/null +++ b/tools/create_index/create_deps_index.js @@ -0,0 +1,56 @@ +const fs = require('node:fs') +const path = require('node:path') + +const depsVulnerabilitiesPath = path.join(__dirname, '../../vuln/deps/') + +// Valid justification values from OpenVEX spec v0.2.0 +// See: https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-justifications +const validJustifications = [ + 'component_not_present', + 'vulnerable_code_not_present', + 'vulnerable_code_not_in_execute_path', + 'vulnerable_code_cannot_be_controlled_by_adversary', + 'inline_mitigations_already_exist' +] + +let vuln = {} + +function createDepsIndex() { + const files = fs.readdirSync(depsVulnerabilitiesPath) + getVulnDirectoryContents(files) + writeIndex(vuln) +} + +function getVulnDirectoryContents(files) { + for (const file of files) { + const filename = file.slice(0, file.toString().indexOf('.json')) + if (filename !== 'index') { + const data = fs.readFileSync(depsVulnerabilitiesPath + file) + const json = JSON.parse(data) + + if (!json.reason) { + throw new Error(`Missing 'reason' field in ${file}`) + } + + if (!validJustifications.includes(json.reason)) { + throw new Error( + `Invalid justification '${json.reason}' in ${file}. ` + + `Valid values are: ${validJustifications.join(', ')}` + ) + } + + createVulnObject(filename, json) + } + } +} + +function createVulnObject(identifier, json) { + vuln[identifier] = json +} + +function writeIndex(data) { + fs.writeFileSync(depsVulnerabilitiesPath + 'index.json', JSON.stringify(data, null, 2)) + console.log('Successfully wrote ' + depsVulnerabilitiesPath + 'index.json for deps vulnerabilities.') +} + +createDepsIndex() diff --git a/tools/ossf_scorecard/database.json b/tools/ossf_scorecard/database.json index d0848d6fe..bb4768cef 100644 --- a/tools/ossf_scorecard/database.json +++ b/tools/ossf_scorecard/database.json @@ -127,12 +127,32 @@ "score": 6.6, "date": "2025-01-06", "commit": "94448fcd9f090814bce1c4361471dae199dc2e82" + }, + { + "score": 5.9, + "date": "2025-03-03", + "commit": "b21cf874f58883f3fd4dd07bec3b584fb07e831d" + }, + { + "score": 5.1, + "date": "2025-07-07", + "commit": "7d883b5cf4c26e76065201f85b0be36d5ebdcc0e" + }, + { + "score": 5.2, + "date": "2025-07-21", + "commit": "3df8789a9aa73c60707eec8f02f4e926491d6102" + }, + { + "score": 5.5, + "date": "2025-08-04", + "commit": "02f747f13b8fea73416ca8e302801f4a3f20a5f6" } ], "current": { - "score": 5.9, - "date": "2025-03-03", - "commit": "b21cf874f58883f3fd4dd07bec3b584fb07e831d" + "score": 6.9, + "date": "2025-08-18", + "commit": "b0ee8a04ec2a32282cb9259f142ca622e67a3d36" } }, "nodejs-ko": { @@ -429,12 +449,37 @@ "score": 6.6, "date": "2025-04-24T05:08:45Z", "commit": "555aeb3aae3b1b91a1c183c6326fd033f491e103" + }, + { + "score": 6.7, + "date": "2025-06-05T12:30:43Z", + "commit": "02a1505efcf7099498240e83327f7c0d71696f47" + }, + { + "score": 6.5, + "date": "2025-07-16T09:17:29Z", + "commit": "229cc3be28eab3153c16bc55bc67d1e81c4a7067" + }, + { + "score": 6.7, + "date": "2025-08-14T09:51:48Z", + "commit": "91f035e5975ad871977f3395664d3162444b3194" + }, + { + "score": 6.6, + "date": "2025-09-11T12:55:02Z", + "commit": "c742220be9c456485f26fdc4adc458dd97de3326" + }, + { + "score": 6.4, + "date": "2025-09-25T09:46:12Z", + "commit": "eb1e671d31a37cd4085ab02ac1eca69fb7d920c4" } ], "current": { - "score": 6.7, - "date": "2025-06-05T12:30:43Z", - "commit": "02a1505efcf7099498240e83327f7c0d71696f47" + "score": 6.3, + "date": "2025-11-06T08:48:51Z", + "commit": "e72761fe5e855747012ba485df77c0e3da189b83" } }, "diagnostics": { @@ -655,12 +700,17 @@ "score": 6.7, "date": "2023-11-13", "commit": "325606f2b43ff922bc5cda93e36f69184213f80c" + }, + { + "score": 7.3, + "date": "2025-04-23T09:25:16Z", + "commit": "b3d8cc15338c545a4328286b2df806b511e2b31b" } ], "current": { - "score": 7.3, - "date": "2025-04-23T09:25:16Z", - "commit": "b3d8cc15338c545a4328286b2df806b511e2b31b" + "score": 7.2, + "date": "2025-11-01T12:43:33Z", + "commit": "bd5b36d8b155ee49ce86df7f3ba29de3485d5688" } }, "nan": { @@ -764,12 +814,27 @@ "score": 6.1, "date": "2025-03-03", "commit": "9585023a32bf0e945c932200fc7f1ddbcf1fadad" + }, + { + "score": 5.9, + "date": "2025-05-26", + "commit": "5a9fcb8f9db0a3de3f74f1fdacb5fe65f190307e" + }, + { + "score": 6.3, + "date": "2025-07-07", + "commit": "675cefebca42410733da8a454c8d9391fcebfbc2" + }, + { + "score": 6, + "date": "2025-08-18", + "commit": "675cefebca42410733da8a454c8d9391fcebfbc2" } ], "current": { - "score": 5.9, - "date": "2025-05-26", - "commit": "5a9fcb8f9db0a3de3f74f1fdacb5fe65f190307e" + "score": 5.4, + "date": "2025-10-27", + "commit": "675cefebca42410733da8a454c8d9391fcebfbc2" } }, "http-parser": { @@ -881,12 +946,22 @@ "score": 6.5, "date": "2025-04-14", "commit": "f782da1ecd9d9cb7523b4d6147155e450dfa7b5f" + }, + { + "score": 6.8, + "date": "2025-05-26", + "commit": "b882d16765f4ef3d9d86d86726102061175cd3bb" + }, + { + "score": 6.7, + "date": "2025-08-25", + "commit": "5fbf89de51208b5b54ae4440cf512823de2b672e" } ], "current": { - "score": 6.8, - "date": "2025-05-26", - "commit": "b882d16765f4ef3d9d86d86726102061175cd3bb" + "score": 6.4, + "date": "2025-10-27", + "commit": "08143bec552cd18829f17678eeada00460fe11a9" } }, "nodejs.org": { @@ -1055,12 +1130,42 @@ "score": 6.6, "date": "2025-04-23T15:31:47Z", "commit": "0b2403976987f6029a485e37965b90b991e61a46" + }, + { + "score": 6.9, + "date": "2025-06-04T21:12:14Z", + "commit": "2054bccf7e18fd65ed2861d4e6940411f3d7e319" + }, + { + "score": 6.8, + "date": "2025-07-16T11:17:11Z", + "commit": "77f675cabeabec5fcb464539d47bff82613c297b" + }, + { + "score": 6.9, + "date": "2025-07-30T15:17:08Z", + "commit": "6b96719fe68e4f77a1243a78456873b0d4ab1107" + }, + { + "score": 7, + "date": "2025-08-13T15:09:06Z", + "commit": "cd078deace2b733e606b8a29d33913713e0afca2" + }, + { + "score": 6.8, + "date": "2025-08-27T23:41:35Z", + "commit": "ba84686416b9a9582b913cce44f24120df50d033" + }, + { + "score": 6.9, + "date": "2025-09-10T21:05:16Z", + "commit": "cafae6f8c3c19c6897583ee3842154e1f899fe61" } ], "current": { - "score": 6.9, - "date": "2025-06-04T21:12:14Z", - "commit": "2054bccf7e18fd65ed2861d4e6940411f3d7e319" + "score": 6.8, + "date": "2025-09-24T23:23:38Z", + "commit": "7439d03c675c609d8418b3c5e9ba2bc4ba28468d" } }, "core-validate-commit": { @@ -1129,11 +1234,16 @@ "score": 5.2, "date": "2024-09-02", "commit": "4556b7ced175f8802ef32a0cb1af273e9bab5c24" + }, + { + "score": 4.8, + "date": "2024-11-11", + "commit": "4556b7ced175f8802ef32a0cb1af273e9bab5c24" } ], "current": { - "score": 4.8, - "date": "2024-11-11", + "score": 4.5, + "date": "2025-07-07", "commit": "4556b7ced175f8802ef32a0cb1af273e9bab5c24" } }, @@ -1263,12 +1373,32 @@ "score": 5.9, "date": "2025-04-14", "commit": "c299fae577ad328689ddf477310dfdd720f97e70" + }, + { + "score": 5.5, + "date": "2025-05-26", + "commit": "c299fae577ad328689ddf477310dfdd720f97e70" + }, + { + "score": 5.1, + "date": "2025-07-07", + "commit": "79167b09c28bb8a81ad824f8c48d8c85a7cac010" + }, + { + "score": 5.2, + "date": "2025-07-21", + "commit": "79167b09c28bb8a81ad824f8c48d8c85a7cac010" + }, + { + "score": 5.1, + "date": "2025-08-18", + "commit": "79167b09c28bb8a81ad824f8c48d8c85a7cac010" } ], "current": { - "score": 5.5, - "date": "2025-05-26", - "commit": "c299fae577ad328689ddf477310dfdd720f97e70" + "score": 6.2, + "date": "2025-10-27", + "commit": "1cbcf4c8d273f3432b9cfea07c499e6de9394458" } }, "TSC": { @@ -1451,12 +1581,32 @@ "score": 5.6, "date": "2025-03-03", "commit": "73b41f5f111baf4ae8cca4a3ff4d7c7db05526f9" + }, + { + "score": 5.3, + "date": "2025-05-26", + "commit": "5a97713ef473bd39ea3dff1a022b674556c284b7" + }, + { + "score": 5.1, + "date": "2025-07-07", + "commit": "5a97713ef473bd39ea3dff1a022b674556c284b7" + }, + { + "score": 5, + "date": "2025-07-21", + "commit": "5a97713ef473bd39ea3dff1a022b674556c284b7" + }, + { + "score": 5.1, + "date": "2025-08-18", + "commit": "6830742332b547989432309bf6a23e4c6d3fd4a1" } ], "current": { - "score": 5.3, - "date": "2025-05-26", - "commit": "5a97713ef473bd39ea3dff1a022b674556c284b7" + "score": 5.5, + "date": "2025-10-27", + "commit": "127143e4bd9ef901bb2b207cc080d76784207068" } }, "help": { @@ -1682,12 +1832,17 @@ "score": 8.1, "date": "2024-10-07T21:24:02Z", "commit": "26cf94dd6bd22393449e1fbf2dcf975fd71cb82c" + }, + { + "score": 8, + "date": "2025-06-02T21:25:50Z", + "commit": "cc80c07860fc94e0edc0565354dbee2149db8650" } ], "current": { - "score": 8, - "date": "2025-06-02T21:25:50Z", - "commit": "cc80c07860fc94e0edc0565354dbee2149db8650" + "score": 7.9, + "date": "2025-09-08T21:24:11Z", + "commit": "4a7b98d0cb5c26e7253647a949632d792ea4346a" } }, "node-addon-api": { @@ -1756,12 +1911,22 @@ "score": 8.1, "date": "2024-09-10T07:25:58Z", "commit": "294a43f8c6a4c79b3295a8f1b83d4782d44cfe74" + }, + { + "score": 8.8, + "date": "2024-11-21T06:45:21Z", + "commit": "5fa31a718d87fd805f5d352df1d8d519c3713bb8" + }, + { + "score": 8.6, + "date": "2025-09-23T07:27:18Z", + "commit": "fc213028f7b5955b5a515fff0d6949c5b896d686" } ], "current": { - "score": 8.8, - "date": "2024-11-21T06:45:21Z", - "commit": "5fa31a718d87fd805f5d352df1d8d519c3713bb8" + "score": 8.5, + "date": "2025-11-04T07:27:59Z", + "commit": "23ce3b17d9155811bf45f487c3aa87fbb4f53836" } }, "tap2junit": { @@ -1845,11 +2010,16 @@ "score": 4.9, "date": "2024-09-02", "commit": "0601e2df056c9a6625eba78c627eab405d09caa8" + }, + { + "score": 4.7, + "date": "2024-09-16", + "commit": "0601e2df056c9a6625eba78c627eab405d09caa8" } ], "current": { - "score": 4.7, - "date": "2024-09-16", + "score": 4.4, + "date": "2025-08-04", "commit": "0601e2df056c9a6625eba78c627eab405d09caa8" } }, @@ -1943,12 +2113,17 @@ "score": 4.6, "date": "2024-11-11", "commit": "371c586c7b245689a97ef6f6757404a80c318f75" + }, + { + "score": 4.3, + "date": "2025-03-03", + "commit": "371c586c7b245689a97ef6f6757404a80c318f75" } ], "current": { - "score": 4.3, - "date": "2025-03-03", - "commit": "371c586c7b245689a97ef6f6757404a80c318f75" + "score": 4.5, + "date": "2025-10-27", + "commit": "7c913bed5cab3b0028d1ed3fbb5152531cbcec34" } }, "remark-preset-lint-node": { @@ -2171,12 +2346,22 @@ "score": 5.5, "date": "2025-03-03", "commit": "2e1f557df07e5f89aaad4e0b2f60f1e6c4516251" + }, + { + "score": 5, + "date": "2025-05-26", + "commit": "2e1f557df07e5f89aaad4e0b2f60f1e6c4516251" + }, + { + "score": 5.1, + "date": "2025-08-04", + "commit": "2e1f557df07e5f89aaad4e0b2f60f1e6c4516251" } ], "current": { - "score": 5, - "date": "2025-05-26", - "commit": "2e1f557df07e5f89aaad4e0b2f60f1e6c4516251" + "score": 5.2, + "date": "2025-10-27", + "commit": "5f7d7a4b6106a4624405c1ec4d728668d774fcdc" } }, "node-core-utils": { @@ -2250,12 +2435,27 @@ "score": 6.7, "date": "2024-11-11", "commit": "dfa9c9201366e9f025034cd40cb5ec9a8968dc9e" + }, + { + "score": 6.6, + "date": "2025-04-14", + "commit": "da77ae1065fe4d9fe2f6e2715da2a536695673c6" + }, + { + "score": 6.5, + "date": "2025-07-07", + "commit": "862883d7842cb8d3d259877b7c5549121c61cf94" + }, + { + "score": 6.4, + "date": "2025-08-04", + "commit": "ba44c7423e9dd18ef2af774973b656803da96a72" } ], "current": { "score": 6.6, - "date": "2025-04-14", - "commit": "da77ae1065fe4d9fe2f6e2715da2a536695673c6" + "date": "2025-10-27", + "commit": "100c6946b167ab7b035db929f779274b79e07694" } }, "lts-schedule": { @@ -2319,12 +2519,17 @@ "score": 4.8, "date": "2024-11-11", "commit": "eab9ef75103b4f2741f995d2eb69bb3e0f8ad135" + }, + { + "score": 4.2, + "date": "2025-03-03", + "commit": "eab9ef75103b4f2741f995d2eb69bb3e0f8ad135" } ], "current": { - "score": 4.2, - "date": "2025-03-03", - "commit": "eab9ef75103b4f2741f995d2eb69bb3e0f8ad135" + "score": 4.3, + "date": "2025-10-27", + "commit": "9214be5592f1e683ca605be5f226f8646b3c8162" } }, "nodejs-dist-indexer": { @@ -2428,12 +2633,37 @@ "score": 5.3, "date": "2025-04-14", "commit": "e0b6cab2e3b86cecbc4bf456f01b8fbd6504cb36" + }, + { + "score": 5.1, + "date": "2025-05-26", + "commit": "7dea933b4d0cbff8e9c6d189271a1f2350a255a9" + }, + { + "score": 4.6, + "date": "2025-07-07", + "commit": "7dea933b4d0cbff8e9c6d189271a1f2350a255a9" + }, + { + "score": 4.4, + "date": "2025-07-21", + "commit": "7dea933b4d0cbff8e9c6d189271a1f2350a255a9" + }, + { + "score": 4.6, + "date": "2025-08-04", + "commit": "1962e183d1fe5fe0270583dea776eb6cf614b242" + }, + { + "score": 4.8, + "date": "2025-08-18", + "commit": "69592a87bb42772ac7844b855670da9855fcecb8" } ], "current": { "score": 5.1, - "date": "2025-05-26", - "commit": "7dea933b4d0cbff8e9c6d189271a1f2350a255a9" + "date": "2025-10-27", + "commit": "caaf5af34214355494d43f8f089d3f4b0afbad20" } }, "undici": { @@ -2562,12 +2792,27 @@ "score": 8.1, "date": "2024-10-10T13:14:10Z", "commit": "9c3ed661e77e21eab407771058b0601fa85bb697" + }, + { + "score": 8.2, + "date": "2025-06-05T08:28:33Z", + "commit": "be11b7dfa9f45335d4ab1a81bb0b13cd4923143d" + }, + { + "score": 8.1, + "date": "2025-08-13T15:42:24Z", + "commit": "c399fdf4246be4992e89efe42aa83062edd0609f" + }, + { + "score": 8.2, + "date": "2025-08-28T08:03:42Z", + "commit": "4d0b0ab8a39a2dc50c75734750a2bc1a9c91da9a" } ], "current": { - "score": 8.2, - "date": "2025-06-05T08:28:33Z", - "commit": "be11b7dfa9f45335d4ab1a81bb0b13cd4923143d" + "score": 8.3, + "date": "2025-09-10T22:57:58Z", + "commit": "4bcde3e916cb8cd81e5009e32eaf782889ec957b" } }, "official-images": { @@ -2611,11 +2856,16 @@ "score": 3.7, "date": "2024-09-30", "commit": "998488aded6d858b073320b7e0d93903005277c1" + }, + { + "score": 4.6, + "date": "2025-05-26", + "commit": "9e49b7d2201238df6457a446a2573cd2fc7fa189" } ], "current": { - "score": 4.6, - "date": "2025-05-26", + "score": 3.7, + "date": "2025-08-18", "commit": "9e49b7d2201238df6457a446a2573cd2fc7fa189" } }, @@ -2744,11 +2994,16 @@ "score": 4.9, "date": "2024-09-02", "commit": "a2ad374b844dffc54986b48c5e9bd53544046e21" + }, + { + "score": 4.8, + "date": "2024-11-25", + "commit": "a2ad374b844dffc54986b48c5e9bd53544046e21" } ], "current": { - "score": 4.8, - "date": "2024-11-25", + "score": 4.7, + "date": "2025-07-07", "commit": "a2ad374b844dffc54986b48c5e9bd53544046e21" } }, @@ -2818,11 +3073,26 @@ "score": 3.7, "date": "2025-03-03", "commit": "e2ae9d4446c58c9508a2904e45bf6b1161287131" + }, + { + "score": 6.5, + "date": "2025-05-26", + "commit": "1c1465134945630c5b91c847f37b661cb3a617b7" + }, + { + "score": 6.4, + "date": "2025-07-07", + "commit": "1c1465134945630c5b91c847f37b661cb3a617b7" + }, + { + "score": 6.1, + "date": "2025-07-21", + "commit": "1c1465134945630c5b91c847f37b661cb3a617b7" } ], "current": { - "score": 6.5, - "date": "2025-05-26", + "score": 5.9, + "date": "2025-08-04", "commit": "1c1465134945630c5b91c847f37b661cb3a617b7" } }, @@ -3118,12 +3388,27 @@ "score": 8.8, "date": "2025-03-11T07:26:13Z", "commit": "515206abdaa6a18cd45a67d32191fe0c66855b89" + }, + { + "score": 8.3, + "date": "2025-06-03T07:29:08Z", + "commit": "eaa71735458a020614b3898d8d97fc9091399594" + }, + { + "score": 8.2, + "date": "2025-07-15T07:30:02Z", + "commit": "eaa71735458a020614b3898d8d97fc9091399594" + }, + { + "score": 8.3, + "date": "2025-08-12T07:29:13Z", + "commit": "c331a2f0912c86ff57d5c2eacd7bc5beeb8f2ebc" } ], "current": { - "score": 8.3, - "date": "2025-06-03T07:29:08Z", - "commit": "eaa71735458a020614b3898d8d97fc9091399594" + "score": 7.7, + "date": "2025-11-04T07:28:01Z", + "commit": "66b05c169e8f0824a6c3415cc459446a69000e88" } }, "package-maintenance": { @@ -3242,12 +3527,42 @@ "score": 6, "date": "2025-03-03", "commit": "2cfd8b130fcbabbe065a579bc34009fe17d7eb59" + }, + { + "score": 6.2, + "date": "2025-04-14", + "commit": "fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8" + }, + { + "score": 5.4, + "date": "2025-07-07", + "commit": "fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8" + }, + { + "score": 5.3, + "date": "2025-07-21", + "commit": "fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8" + }, + { + "score": 5.4, + "date": "2025-08-04", + "commit": "fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8" + }, + { + "score": 6.1, + "date": "2025-08-18", + "commit": "d596a7ee8b6ce4d39a135cc5b1e8ddab011d1825" + }, + { + "score": 6.2, + "date": "2025-08-25", + "commit": "d596a7ee8b6ce4d39a135cc5b1e8ddab011d1825" } ], "current": { - "score": 6.2, - "date": "2025-04-14", - "commit": "fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8" + "score": 6.5, + "date": "2025-10-27", + "commit": "4257d53e63041f84ac439c1d4f83f873138cdc51" } }, "gyp-next": { @@ -3361,12 +3676,32 @@ "score": 5.8, "date": "2025-03-03", "commit": "46fc91f1fa0aeb72a2581ea6996f5e37f7a2e9ce" + }, + { + "score": 5.9, + "date": "2025-04-14", + "commit": "e97fd2509a6fb6452eab5e9b17f4cae3fc49f25e" + }, + { + "score": 5.7, + "date": "2025-07-07", + "commit": "198fcf91682346f74de1a15f1fadfcad9c3ba670" + }, + { + "score": 6.4, + "date": "2025-08-04", + "commit": "198fcf91682346f74de1a15f1fadfcad9c3ba670" + }, + { + "score": 6.8, + "date": "2025-08-18", + "commit": "2ea7c2c95140074d7813b92c42617f9eae01b9eb" } ], "current": { - "score": 5.9, - "date": "2025-04-14", - "commit": "e97fd2509a6fb6452eab5e9b17f4cae3fc49f25e" + "score": 6.9, + "date": "2025-08-25", + "commit": "94c13e077944f84dcd62e4861ea565c141af2067" } }, "whatwg-stream": { @@ -3529,12 +3864,27 @@ "score": 5.3, "date": "2025-04-14", "commit": "aefde28a631356bfdec91795d2c60be07dbf5be3" + }, + { + "score": 5.5, + "date": "2025-05-26", + "commit": "b45b3a3244bacfbaf65188ae8c04209a1e98307d" + }, + { + "score": 5.3, + "date": "2025-07-07", + "commit": "15498ddb9ac717d3ea52871b8b29884a470424de" + }, + { + "score": 5.5, + "date": "2025-08-18", + "commit": "57bfb67b062ea1b8746b302bcdbf9f8e8438c526" } ], "current": { - "score": 5.5, - "date": "2025-05-26", - "commit": "b45b3a3244bacfbaf65188ae8c04209a1e98307d" + "score": 5.9, + "date": "2025-10-27", + "commit": "7e0758e4fd920859ad92adf204caf766b242f1af" } }, "uvwasi": { @@ -3623,12 +3973,37 @@ "score": 6.5, "date": "2025-04-14", "commit": "6eeddbae277693bc022e59e54649ec13eed478c7" + }, + { + "score": 6.7, + "date": "2025-05-26", + "commit": "392e1f1c1c8a2d2102c9f2e0b9f35959a149d133" + }, + { + "score": 6.6, + "date": "2025-07-21", + "commit": "392e1f1c1c8a2d2102c9f2e0b9f35959a149d133" + }, + { + "score": 6.4, + "date": "2025-08-04", + "commit": "392e1f1c1c8a2d2102c9f2e0b9f35959a149d133" + }, + { + "score": 6.7, + "date": "2025-08-18", + "commit": "ec28b580a7684a2c319952ff2eb1a5cfc0dea441" + }, + { + "score": 6.6, + "date": "2025-08-25", + "commit": "94a9f59482ef1747c65564cb40a9c162e03f1e00" } ], "current": { - "score": 6.7, - "date": "2025-05-26", - "commit": "392e1f1c1c8a2d2102c9f2e0b9f35959a149d133" + "score": 7.1, + "date": "2025-10-27", + "commit": "cbd1962f851c0ca7e62c2875affe0c4dee68e4ac" } }, "node-auto-test": { @@ -3670,12 +4045,17 @@ "score": 8.8, "date": "2024-12-03T07:26:23Z", "commit": "b3d756187a24e88a5f9e1143a5490889cd67d6d2" + }, + { + "score": 8.7, + "date": "2025-06-05T13:35:41Z", + "commit": "440da3604e1e3507af3bbb86607fadeb566e5afc" } ], "current": { - "score": 8.7, - "date": "2025-06-05T13:35:41Z", - "commit": "440da3604e1e3507af3bbb86607fadeb566e5afc" + "score": 8.6, + "date": "2025-07-16T20:02:30Z", + "commit": "0d6d689bf8458e6ad542352c915dfa4a4b413e32" } }, "amaro": { @@ -3689,12 +4069,85 @@ "score": 6.8, "date": "2025-04-22T07:27:25Z", "commit": "b57b09c168d0f54012d0529b682804e9124d3362" + }, + { + "score": 6.9, + "date": "2025-06-03T07:28:52Z", + "commit": "40a7cc9137eb6636b6d775d87b1d9cf8a6473e99" + }, + { + "score": 7, + "date": "2025-07-31T08:31:02Z", + "commit": "55bb450284cbaa1fa8431ee3643a33143266b16c" + }, + { + "score": 7.1, + "date": "2025-08-12T07:29:01Z", + "commit": "594f836d15900864e4313f48687321ecd41f9130" } ], "current": { - "score": 6.9, - "date": "2025-06-03T07:28:52Z", - "commit": "40a7cc9137eb6636b6d775d87b1d9cf8a6473e99" + "score": 7.2, + "date": "2025-11-04T07:28:12Z", + "commit": "9b58426d45df80d42499c1b2ad3b59140ce8b532" + } + }, + "web-team": { + "previous": [ + { + "score": 7, + "date": "2025-07-15T07:30:04Z", + "commit": "3f60687a74488d931d4ab7b844e3497468d5bb7f" + }, + { + "score": 7.6, + "date": "2025-07-29T07:30:12Z", + "commit": "21a321a153646a548ca9051257461983647234b1" + }, + { + "score": 7.5, + "date": "2025-08-26T07:27:51Z", + "commit": "74cbb4801de8068e1908b718c95f139a3f95726a" + }, + { + "score": 7.6, + "date": "2025-09-09T07:26:44Z", + "commit": "478d9bfd069b871e22df8609ba0bb94fcd2b4ce8" + }, + { + "score": 8.5, + "date": "2025-09-24T20:27:57Z", + "commit": "1ca4b8093b7fc399b63368857543004862fc93e1" + } + ], + "current": { + "score": 8.7, + "date": "2025-11-04T07:28:13Z", + "commit": "c421732ffed193f88239c2fd3f6aac081328311f" + } + }, + "doc-kit": { + "previous": [ + { + "score": 8.5, + "date": "2025-07-29T16:25:03Z", + "commit": "53b457da62dd4adc7e61bb8ec506d04d1bbcc3b1" + }, + { + "score": 7.8, + "date": "2025-08-14T01:42:21Z", + "commit": "a16716103ead462126107c0a41e0fafa0fc14560" + }, + { + "score": 8.7, + "date": "2025-09-10T20:47:01Z", + "commit": "4c6ffae6e9c4c5ed6193324ecce4fab524ce8dbe" + } + ], + "current": { + "score": 8.6, + "date": "2025-11-04T12:12:53Z", + "commit": "b7998083882a981d06710e7c6681e69ffd73535c" } } } diff --git a/tools/ossf_scorecard/report.md b/tools/ossf_scorecard/report.md index 8a0e098df..e2cf7de7b 100644 --- a/tools/ossf_scorecard/report.md +++ b/tools/ossf_scorecard/report.md @@ -2,42 +2,44 @@ | Repository | Commit | Score | Date | Score Delta | Report | StepSecurity | | -- | -- | -- | -- | -- | -- | -- | -| [nodejs/readable-stream](https://github.com/nodejs/readable-stream) | [88df210](https://github.com/nodejs/readable-stream/commit/88df21041dc26c210fab3e074ab6bb681a604b8e) | 5.4 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/readable-stream/compare/88df21041dc26c210fab3e074ab6bb681a604b8e/88df21041dc26c210fab3e074ab6bb681a604b8e) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/readable-stream/commit/88df21041dc26c210fab3e074ab6bb681a604b8e) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/readable-stream) | -| [nodejs/node-gyp](https://github.com/nodejs/node-gyp) | [7d883b5](https://github.com/nodejs/node-gyp/commit/7d883b5cf4c26e76065201f85b0be36d5ebdcc0e) | 5.9 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-gyp/compare/b21cf874f58883f3fd4dd07bec3b584fb07e831d/7d883b5cf4c26e76065201f85b0be36d5ebdcc0e) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-gyp/commit/7d883b5cf4c26e76065201f85b0be36d5ebdcc0e) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-gyp) | -| [nodejs/nan](https://github.com/nodejs/nan) | [5a9fcb8](https://github.com/nodejs/nan/commit/5a9fcb8f9db0a3de3f74f1fdacb5fe65f190307e) | 5.9 | 2025-05-26 | -0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nan/compare/9585023a32bf0e945c932200fc7f1ddbcf1fadad/5a9fcb8f9db0a3de3f74f1fdacb5fe65f190307e) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nan/commit/5a9fcb8f9db0a3de3f74f1fdacb5fe65f190307e) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nan) | -| [nodejs/build](https://github.com/nodejs/build) | [f9d03b9](https://github.com/nodejs/build/commit/f9d03b95baaeb06d5268b9700bf837a2d24b9417) | 6.3 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/build/compare/62a7c769f6aee5537efaa40083851af9295f01a8/f9d03b95baaeb06d5268b9700bf837a2d24b9417) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/build/commit/f9d03b95baaeb06d5268b9700bf837a2d24b9417) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/build) | +| [nodejs/readable-stream](https://github.com/nodejs/readable-stream) | [88df210](https://github.com/nodejs/readable-stream/commit/88df21041dc26c210fab3e074ab6bb681a604b8e) | 5.4 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/readable-stream/compare/88df21041dc26c210fab3e074ab6bb681a604b8e/88df21041dc26c210fab3e074ab6bb681a604b8e) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/readable-stream/commit/88df21041dc26c210fab3e074ab6bb681a604b8e) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/readable-stream) | +| [nodejs/node-gyp](https://github.com/nodejs/node-gyp) | [3cff859](https://github.com/nodejs/node-gyp/commit/3cff85955e6ec8973fc6703ed937313b30bc0093) | 6.9 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-gyp/compare/b0ee8a04ec2a32282cb9259f142ca622e67a3d36/3cff85955e6ec8973fc6703ed937313b30bc0093) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-gyp/commit/3cff85955e6ec8973fc6703ed937313b30bc0093) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-gyp) | +| [nodejs/nan](https://github.com/nodejs/nan) | [675cefe](https://github.com/nodejs/nan/commit/675cefebca42410733da8a454c8d9391fcebfbc2) | 5.4 | 2025-10-27 | -0.6 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nan/compare/675cefebca42410733da8a454c8d9391fcebfbc2/675cefebca42410733da8a454c8d9391fcebfbc2) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nan/commit/675cefebca42410733da8a454c8d9391fcebfbc2) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nan) | +| [nodejs/build](https://github.com/nodejs/build) | [533553f](https://github.com/nodejs/build/commit/533553f63c075253685bef6c616aaf7da4050bdc) | 6.3 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/build/compare/62a7c769f6aee5537efaa40083851af9295f01a8/533553f63c075253685bef6c616aaf7da4050bdc) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/build/commit/533553f63c075253685bef6c616aaf7da4050bdc) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/build) | | [nodejs/diagnostics](https://github.com/nodejs/diagnostics) | [adab8d6](https://github.com/nodejs/diagnostics/commit/adab8d62aca9e47928570c29e7e5908a0f825039) | 5.9 | 2024-03-19 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/diagnostics/compare/adab8d62aca9e47928570c29e7e5908a0f825039/adab8d62aca9e47928570c29e7e5908a0f825039) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/diagnostics/commit/adab8d62aca9e47928570c29e7e5908a0f825039) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/diagnostics) | -| [nodejs/node](https://github.com/nodejs/node) | [02a1505](https://github.com/nodejs/node/commit/02a1505efcf7099498240e83327f7c0d71696f47) | 6.7 | 2025-06-05T12:30:43Z | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/compare/555aeb3aae3b1b91a1c183c6326fd033f491e103/02a1505efcf7099498240e83327f7c0d71696f47) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/commit/02a1505efcf7099498240e83327f7c0d71696f47) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node) | -| [nodejs/docker-node](https://github.com/nodejs/docker-node) | [482aa41](https://github.com/nodejs/docker-node/commit/482aa41f55315b0801ecba0e2f0ee6095def3c3f) | 7.3 | 2025-06-03T20:11:52Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/docker-node/compare/b3d8cc15338c545a4328286b2df806b511e2b31b/482aa41f55315b0801ecba0e2f0ee6095def3c3f) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/docker-node/commit/482aa41f55315b0801ecba0e2f0ee6095def3c3f) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/docker-node) | -| [nodejs/changelog-maker](https://github.com/nodejs/changelog-maker) | [5a97713](https://github.com/nodejs/changelog-maker/commit/5a97713ef473bd39ea3dff1a022b674556c284b7) | 5.3 | 2025-05-26 | -0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/changelog-maker/compare/73b41f5f111baf4ae8cca4a3ff4d7c7db05526f9/5a97713ef473bd39ea3dff1a022b674556c284b7) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/changelog-maker/commit/5a97713ef473bd39ea3dff1a022b674556c284b7) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/changelog-maker) | -| [nodejs/Release](https://github.com/nodejs/Release) | [b882d16](https://github.com/nodejs/Release/commit/b882d16765f4ef3d9d86d86726102061175cd3bb) | 6.8 | 2025-05-26 | 0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/Release/compare/f782da1ecd9d9cb7523b4d6147155e450dfa7b5f/b882d16765f4ef3d9d86d86726102061175cd3bb) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/Release/commit/b882d16765f4ef3d9d86d86726102061175cd3bb) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/Release) | -| [nodejs/nodejs.org](https://github.com/nodejs/nodejs.org) | [2054bcc](https://github.com/nodejs/nodejs.org/commit/2054bccf7e18fd65ed2861d4e6940411f3d7e319) | 6.9 | 2025-06-04T21:12:14Z | 0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs.org/compare/0b2403976987f6029a485e37965b90b991e61a46/2054bccf7e18fd65ed2861d4e6940411f3d7e319) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs.org/commit/2054bccf7e18fd65ed2861d4e6940411f3d7e319) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs.org) | -| [nodejs/citgm](https://github.com/nodejs/citgm) | [c299fae](https://github.com/nodejs/citgm/commit/c299fae577ad328689ddf477310dfdd720f97e70) | 5.5 | 2025-05-26 | -0.4 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/citgm/compare/c299fae577ad328689ddf477310dfdd720f97e70/c299fae577ad328689ddf477310dfdd720f97e70) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/citgm/commit/c299fae577ad328689ddf477310dfdd720f97e70) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/citgm) | -| [nodejs/TSC](https://github.com/nodejs/TSC) | [d98db5c](https://github.com/nodejs/TSC/commit/d98db5c241f62cc9cf223e9166386d55273bc119) | 6.2 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/TSC/compare/bce05f3237079856ef8fb5e97d819e9a2b08bbcf/d98db5c241f62cc9cf223e9166386d55273bc119) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/TSC/commit/d98db5c241f62cc9cf223e9166386d55273bc119) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/TSC) | -| [nodejs/llnode](https://github.com/nodejs/llnode) | [de1f01d](https://github.com/nodejs/llnode/commit/de1f01d70a5c58111dd873d340f898023e4e8fe6) | 5.4 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llnode/compare/de1f01d70a5c58111dd873d340f898023e4e8fe6/de1f01d70a5c58111dd873d340f898023e4e8fe6) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llnode/commit/de1f01d70a5c58111dd873d340f898023e4e8fe6) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llnode) | -| [nodejs/core-validate-commit](https://github.com/nodejs/core-validate-commit) | [4556b7c](https://github.com/nodejs/core-validate-commit/commit/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | 4.8 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/core-validate-commit/compare/4556b7ced175f8802ef32a0cb1af273e9bab5c24/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/core-validate-commit/commit/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/core-validate-commit) | -| [nodejs/nodejs-nightly-builder](https://github.com/nodejs/nodejs-nightly-builder) | [00c8135](https://github.com/nodejs/nodejs-nightly-builder/commit/00c8135102b0e272ed1d8950845a5412cc9bc237) | 4 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-nightly-builder/compare/00c8135102b0e272ed1d8950845a5412cc9bc237/00c8135102b0e272ed1d8950845a5412cc9bc237) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-nightly-builder/commit/00c8135102b0e272ed1d8950845a5412cc9bc237) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-nightly-builder) | -| [nodejs/nodejs-dist-indexer](https://github.com/nodejs/nodejs-dist-indexer) | [7dea933](https://github.com/nodejs/nodejs-dist-indexer/commit/7dea933b4d0cbff8e9c6d189271a1f2350a255a9) | 5.1 | 2025-05-26 | -0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-dist-indexer/compare/e0b6cab2e3b86cecbc4bf456f01b8fbd6504cb36/7dea933b4d0cbff8e9c6d189271a1f2350a255a9) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-dist-indexer/commit/7dea933b4d0cbff8e9c6d189271a1f2350a255a9) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-dist-indexer) | -| [nodejs/security-wg](https://github.com/nodejs/security-wg) | [cc80c07](https://github.com/nodejs/security-wg/commit/cc80c07860fc94e0edc0565354dbee2149db8650) | 8 | 2025-06-02T21:25:50Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/security-wg/compare/26cf94dd6bd22393449e1fbf2dcf975fd71cb82c/cc80c07860fc94e0edc0565354dbee2149db8650) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/security-wg/commit/cc80c07860fc94e0edc0565354dbee2149db8650) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/security-wg) | -| [nodejs/tap2junit](https://github.com/nodejs/tap2junit) | [0601e2d](https://github.com/nodejs/tap2junit/commit/0601e2df056c9a6625eba78c627eab405d09caa8) | 4.7 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/tap2junit/compare/0601e2df056c9a6625eba78c627eab405d09caa8/0601e2df056c9a6625eba78c627eab405d09caa8) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/tap2junit/commit/0601e2df056c9a6625eba78c627eab405d09caa8) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/tap2junit) | -| [nodejs/node-addon-api](https://github.com/nodejs/node-addon-api) | [1e57a0a](https://github.com/nodejs/node-addon-api/commit/1e57a0ae82786c320c784ec6b67f357c85733132) | 8.8 | 2025-06-03T07:28:40Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-addon-api/compare/5fa31a718d87fd805f5d352df1d8d519c3713bb8/1e57a0ae82786c320c784ec6b67f357c85733132) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-addon-api/commit/1e57a0ae82786c320c784ec6b67f357c85733132) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-addon-api) | -| [nodejs/node-v8](https://github.com/nodejs/node-v8) | [2e1f557](https://github.com/nodejs/node-v8/commit/2e1f557df07e5f89aaad4e0b2f60f1e6c4516251) | 5 | 2025-05-26 | -0.5 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-v8/compare/2e1f557df07e5f89aaad4e0b2f60f1e6c4516251/2e1f557df07e5f89aaad4e0b2f60f1e6c4516251) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-v8/commit/2e1f557df07e5f89aaad4e0b2f60f1e6c4516251) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-v8) | -| [nodejs/nodejs-latest-linker](https://github.com/nodejs/nodejs-latest-linker) | [371c586](https://github.com/nodejs/nodejs-latest-linker/commit/371c586c7b245689a97ef6f6757404a80c318f75) | 4.3 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-latest-linker/compare/371c586c7b245689a97ef6f6757404a80c318f75/371c586c7b245689a97ef6f6757404a80c318f75) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-latest-linker/commit/371c586c7b245689a97ef6f6757404a80c318f75) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-latest-linker) | -| [nodejs/lts-schedule](https://github.com/nodejs/lts-schedule) | [eab9ef7](https://github.com/nodejs/lts-schedule/commit/eab9ef75103b4f2741f995d2eb69bb3e0f8ad135) | 4.2 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/lts-schedule/compare/eab9ef75103b4f2741f995d2eb69bb3e0f8ad135/eab9ef75103b4f2741f995d2eb69bb3e0f8ad135) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/lts-schedule/commit/eab9ef75103b4f2741f995d2eb69bb3e0f8ad135) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/lts-schedule) | -| [nodejs/node-core-utils](https://github.com/nodejs/node-core-utils) | [a68af4b](https://github.com/nodejs/node-core-utils/commit/a68af4b7744e8416bfc0f062570688b67d5e10dc) | 6.6 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-core-utils/compare/da77ae1065fe4d9fe2f6e2715da2a536695673c6/a68af4b7744e8416bfc0f062570688b67d5e10dc) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-core-utils/commit/a68af4b7744e8416bfc0f062570688b67d5e10dc) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-core-utils) | -| [nodejs/string_decoder](https://github.com/nodejs/string_decoder) | [1f29dd7](https://github.com/nodejs/string_decoder/commit/1f29dd715a6c829da89e869af7dafc231c20ed9f) | 4.3 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/string_decoder/compare/1f29dd715a6c829da89e869af7dafc231c20ed9f/1f29dd715a6c829da89e869af7dafc231c20ed9f) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/string_decoder/commit/1f29dd715a6c829da89e869af7dafc231c20ed9f) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/string_decoder) | -| [nodejs/llhttp](https://github.com/nodejs/llhttp) | [eaa7173](https://github.com/nodejs/llhttp/commit/eaa71735458a020614b3898d8d97fc9091399594) | 8.3 | 2025-06-03T07:29:08Z | -0.5 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llhttp/compare/515206abdaa6a18cd45a67d32191fe0c66855b89/eaa71735458a020614b3898d8d97fc9091399594) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llhttp/commit/eaa71735458a020614b3898d8d97fc9091399594) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llhttp) | -| [nodejs/llparse](https://github.com/nodejs/llparse) | [1c14651](https://github.com/nodejs/llparse/commit/1c1465134945630c5b91c847f37b661cb3a617b7) | 6.5 | 2025-05-26 | 2.8 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llparse/compare/e2ae9d4446c58c9508a2904e45bf6b1161287131/1c1465134945630c5b91c847f37b661cb3a617b7) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llparse/commit/1c1465134945630c5b91c847f37b661cb3a617b7) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llparse) | -| [nodejs/meeting-picker](https://github.com/nodejs/meeting-picker) | [a2ad374](https://github.com/nodejs/meeting-picker/commit/a2ad374b844dffc54986b48c5e9bd53544046e21) | 4.8 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/meeting-picker/compare/a2ad374b844dffc54986b48c5e9bd53544046e21/a2ad374b844dffc54986b48c5e9bd53544046e21) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/meeting-picker/commit/a2ad374b844dffc54986b48c5e9bd53544046e21) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/meeting-picker) | -| [nodejs/undici](https://github.com/nodejs/undici) | [be11b7d](https://github.com/nodejs/undici/commit/be11b7dfa9f45335d4ab1a81bb0b13cd4923143d) | 8.2 | 2025-06-05T08:28:33Z | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/undici/compare/9c3ed661e77e21eab407771058b0601fa85bb697/be11b7dfa9f45335d4ab1a81bb0b13cd4923143d) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/undici/commit/be11b7dfa9f45335d4ab1a81bb0b13cd4923143d) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/undici) | -| [nodejs/official-images](https://github.com/nodejs/official-images) | [9e49b7d](https://github.com/nodejs/official-images/commit/9e49b7d2201238df6457a446a2573cd2fc7fa189) | 4.6 | 2025-05-26 | 0.9 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/official-images/compare/998488aded6d858b073320b7e0d93903005277c1/9e49b7d2201238df6457a446a2573cd2fc7fa189) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/official-images/commit/9e49b7d2201238df6457a446a2573cd2fc7fa189) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/official-images) | -| [nodejs/package-maintenance](https://github.com/nodejs/package-maintenance) | [fe7ccca](https://github.com/nodejs/package-maintenance/commit/fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8) | 6.2 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/package-maintenance/compare/fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8/fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/package-maintenance/commit/fe7cccac6f9a8e0628cb3fe0173c6822240e5eb8) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/package-maintenance) | -| [nodejs/uvwasi](https://github.com/nodejs/uvwasi) | [392e1f1](https://github.com/nodejs/uvwasi/commit/392e1f1c1c8a2d2102c9f2e0b9f35959a149d133) | 6.7 | 2025-05-26 | 0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/uvwasi/compare/6eeddbae277693bc022e59e54649ec13eed478c7/392e1f1c1c8a2d2102c9f2e0b9f35959a149d133) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/uvwasi/commit/392e1f1c1c8a2d2102c9f2e0b9f35959a149d133) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/uvwasi) | -| [nodejs/corepack](https://github.com/nodejs/corepack) | [b45b3a3](https://github.com/nodejs/corepack/commit/b45b3a3244bacfbaf65188ae8c04209a1e98307d) | 5.5 | 2025-05-26 | 0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/corepack/compare/aefde28a631356bfdec91795d2c60be07dbf5be3/b45b3a3244bacfbaf65188ae8c04209a1e98307d) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/corepack/commit/b45b3a3244bacfbaf65188ae8c04209a1e98307d) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/corepack) | -| [nodejs/gyp-next](https://github.com/nodejs/gyp-next) | [e7c982c](https://github.com/nodejs/gyp-next/commit/e7c982cf785d68f61d3880e08861a8da3b2321c1) | 5.9 | 2025-05-26 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/gyp-next/compare/e97fd2509a6fb6452eab5e9b17f4cae3fc49f25e/e7c982cf785d68f61d3880e08861a8da3b2321c1) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/gyp-next/commit/e7c982cf785d68f61d3880e08861a8da3b2321c1) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/gyp-next) | +| [nodejs/node](https://github.com/nodejs/node) | [e72761f](https://github.com/nodejs/node/commit/e72761fe5e855747012ba485df77c0e3da189b83) | 6.3 | 2025-11-06T08:48:51Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/compare/eb1e671d31a37cd4085ab02ac1eca69fb7d920c4/e72761fe5e855747012ba485df77c0e3da189b83) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node/commit/e72761fe5e855747012ba485df77c0e3da189b83) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node) | +| [nodejs/docker-node](https://github.com/nodejs/docker-node) | [bd5b36d](https://github.com/nodejs/docker-node/commit/bd5b36d8b155ee49ce86df7f3ba29de3485d5688) | 7.2 | 2025-11-01T12:43:33Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/docker-node/compare/b3d8cc15338c545a4328286b2df806b511e2b31b/bd5b36d8b155ee49ce86df7f3ba29de3485d5688) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/docker-node/commit/bd5b36d8b155ee49ce86df7f3ba29de3485d5688) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/docker-node) | +| [nodejs/changelog-maker](https://github.com/nodejs/changelog-maker) | [127143e](https://github.com/nodejs/changelog-maker/commit/127143e4bd9ef901bb2b207cc080d76784207068) | 5.5 | 2025-10-27 | 0.4 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/changelog-maker/compare/6830742332b547989432309bf6a23e4c6d3fd4a1/127143e4bd9ef901bb2b207cc080d76784207068) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/changelog-maker/commit/127143e4bd9ef901bb2b207cc080d76784207068) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/changelog-maker) | +| [nodejs/Release](https://github.com/nodejs/Release) | [08143be](https://github.com/nodejs/Release/commit/08143bec552cd18829f17678eeada00460fe11a9) | 6.4 | 2025-10-27 | -0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/Release/compare/5fbf89de51208b5b54ae4440cf512823de2b672e/08143bec552cd18829f17678eeada00460fe11a9) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/Release/commit/08143bec552cd18829f17678eeada00460fe11a9) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/Release) | +| [nodejs/nodejs.org](https://github.com/nodejs/nodejs.org) | [76ee24a](https://github.com/nodejs/nodejs.org/commit/76ee24ac10b746cb8cfec030e3d9b3244f9c8e9a) | 6.8 | 2025-10-11T17:09:54Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs.org/compare/7439d03c675c609d8418b3c5e9ba2bc4ba28468d/76ee24ac10b746cb8cfec030e3d9b3244f9c8e9a) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs.org/commit/76ee24ac10b746cb8cfec030e3d9b3244f9c8e9a) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs.org) | +| [nodejs/citgm](https://github.com/nodejs/citgm) | [1cbcf4c](https://github.com/nodejs/citgm/commit/1cbcf4c8d273f3432b9cfea07c499e6de9394458) | 6.2 | 2025-10-27 | 1.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/citgm/compare/79167b09c28bb8a81ad824f8c48d8c85a7cac010/1cbcf4c8d273f3432b9cfea07c499e6de9394458) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/citgm/commit/1cbcf4c8d273f3432b9cfea07c499e6de9394458) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/citgm) | +| [nodejs/TSC](https://github.com/nodejs/TSC) | [19231e5](https://github.com/nodejs/TSC/commit/19231e55dbd777715aa1e7892bcfef649b73fd8e) | 6.2 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/TSC/compare/bce05f3237079856ef8fb5e97d819e9a2b08bbcf/19231e55dbd777715aa1e7892bcfef649b73fd8e) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/TSC/commit/19231e55dbd777715aa1e7892bcfef649b73fd8e) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/TSC) | +| [nodejs/llnode](https://github.com/nodejs/llnode) | [de1f01d](https://github.com/nodejs/llnode/commit/de1f01d70a5c58111dd873d340f898023e4e8fe6) | 5.4 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llnode/compare/de1f01d70a5c58111dd873d340f898023e4e8fe6/de1f01d70a5c58111dd873d340f898023e4e8fe6) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llnode/commit/de1f01d70a5c58111dd873d340f898023e4e8fe6) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llnode) | +| [nodejs/core-validate-commit](https://github.com/nodejs/core-validate-commit) | [4556b7c](https://github.com/nodejs/core-validate-commit/commit/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | 4.5 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/core-validate-commit/compare/4556b7ced175f8802ef32a0cb1af273e9bab5c24/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/core-validate-commit/commit/4556b7ced175f8802ef32a0cb1af273e9bab5c24) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/core-validate-commit) | +| [nodejs/nodejs-nightly-builder](https://github.com/nodejs/nodejs-nightly-builder) | [00c8135](https://github.com/nodejs/nodejs-nightly-builder/commit/00c8135102b0e272ed1d8950845a5412cc9bc237) | 4 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-nightly-builder/compare/00c8135102b0e272ed1d8950845a5412cc9bc237/00c8135102b0e272ed1d8950845a5412cc9bc237) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-nightly-builder/commit/00c8135102b0e272ed1d8950845a5412cc9bc237) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-nightly-builder) | +| [nodejs/nodejs-dist-indexer](https://github.com/nodejs/nodejs-dist-indexer) | [caaf5af](https://github.com/nodejs/nodejs-dist-indexer/commit/caaf5af34214355494d43f8f089d3f4b0afbad20) | 5.1 | 2025-10-27 | 0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-dist-indexer/compare/69592a87bb42772ac7844b855670da9855fcecb8/caaf5af34214355494d43f8f089d3f4b0afbad20) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-dist-indexer/commit/caaf5af34214355494d43f8f089d3f4b0afbad20) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-dist-indexer) | +| [nodejs/security-wg](https://github.com/nodejs/security-wg) | [b5b00d9](https://github.com/nodejs/security-wg/commit/b5b00d98b425fe196bd846ccc7b95dbb81564c25) | 7.9 | 2025-11-03T21:25:11Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/security-wg/compare/4a7b98d0cb5c26e7253647a949632d792ea4346a/b5b00d98b425fe196bd846ccc7b95dbb81564c25) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/security-wg/commit/b5b00d98b425fe196bd846ccc7b95dbb81564c25) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/security-wg) | +| [nodejs/tap2junit](https://github.com/nodejs/tap2junit) | [0601e2d](https://github.com/nodejs/tap2junit/commit/0601e2df056c9a6625eba78c627eab405d09caa8) | 4.4 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/tap2junit/compare/0601e2df056c9a6625eba78c627eab405d09caa8/0601e2df056c9a6625eba78c627eab405d09caa8) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/tap2junit/commit/0601e2df056c9a6625eba78c627eab405d09caa8) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/tap2junit) | +| [nodejs/node-addon-api](https://github.com/nodejs/node-addon-api) | [23ce3b1](https://github.com/nodejs/node-addon-api/commit/23ce3b17d9155811bf45f487c3aa87fbb4f53836) | 8.5 | 2025-11-04T07:27:59Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-addon-api/compare/fc213028f7b5955b5a515fff0d6949c5b896d686/23ce3b17d9155811bf45f487c3aa87fbb4f53836) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-addon-api/commit/23ce3b17d9155811bf45f487c3aa87fbb4f53836) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-addon-api) | +| [nodejs/node-v8](https://github.com/nodejs/node-v8) | [5f7d7a4](https://github.com/nodejs/node-v8/commit/5f7d7a4b6106a4624405c1ec4d728668d774fcdc) | 5.2 | 2025-10-27 | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-v8/compare/2e1f557df07e5f89aaad4e0b2f60f1e6c4516251/5f7d7a4b6106a4624405c1ec4d728668d774fcdc) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-v8/commit/5f7d7a4b6106a4624405c1ec4d728668d774fcdc) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-v8) | +| [nodejs/nodejs-latest-linker](https://github.com/nodejs/nodejs-latest-linker) | [7c913be](https://github.com/nodejs/nodejs-latest-linker/commit/7c913bed5cab3b0028d1ed3fbb5152531cbcec34) | 4.5 | 2025-10-27 | 0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-latest-linker/compare/371c586c7b245689a97ef6f6757404a80c318f75/7c913bed5cab3b0028d1ed3fbb5152531cbcec34) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/nodejs-latest-linker/commit/7c913bed5cab3b0028d1ed3fbb5152531cbcec34) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/nodejs-latest-linker) | +| [nodejs/lts-schedule](https://github.com/nodejs/lts-schedule) | [9214be5](https://github.com/nodejs/lts-schedule/commit/9214be5592f1e683ca605be5f226f8646b3c8162) | 4.3 | 2025-10-27 | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/lts-schedule/compare/eab9ef75103b4f2741f995d2eb69bb3e0f8ad135/9214be5592f1e683ca605be5f226f8646b3c8162) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/lts-schedule/commit/9214be5592f1e683ca605be5f226f8646b3c8162) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/lts-schedule) | +| [nodejs/node-core-utils](https://github.com/nodejs/node-core-utils) | [100c694](https://github.com/nodejs/node-core-utils/commit/100c6946b167ab7b035db929f779274b79e07694) | 6.6 | 2025-10-27 | 0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-core-utils/compare/ba44c7423e9dd18ef2af774973b656803da96a72/100c6946b167ab7b035db929f779274b79e07694) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-core-utils/commit/100c6946b167ab7b035db929f779274b79e07694) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-core-utils) | +| [nodejs/string_decoder](https://github.com/nodejs/string_decoder) | [1f29dd7](https://github.com/nodejs/string_decoder/commit/1f29dd715a6c829da89e869af7dafc231c20ed9f) | 4.3 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/string_decoder/compare/1f29dd715a6c829da89e869af7dafc231c20ed9f/1f29dd715a6c829da89e869af7dafc231c20ed9f) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/string_decoder/commit/1f29dd715a6c829da89e869af7dafc231c20ed9f) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/string_decoder) | +| [nodejs/llhttp](https://github.com/nodejs/llhttp) | [66b05c1](https://github.com/nodejs/llhttp/commit/66b05c169e8f0824a6c3415cc459446a69000e88) | 7.7 | 2025-11-04T07:28:01Z | -0.6 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llhttp/compare/c331a2f0912c86ff57d5c2eacd7bc5beeb8f2ebc/66b05c169e8f0824a6c3415cc459446a69000e88) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llhttp/commit/66b05c169e8f0824a6c3415cc459446a69000e88) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llhttp) | +| [nodejs/llparse](https://github.com/nodejs/llparse) | [1c14651](https://github.com/nodejs/llparse/commit/1c1465134945630c5b91c847f37b661cb3a617b7) | 5.9 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llparse/compare/1c1465134945630c5b91c847f37b661cb3a617b7/1c1465134945630c5b91c847f37b661cb3a617b7) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/llparse/commit/1c1465134945630c5b91c847f37b661cb3a617b7) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/llparse) | +| [nodejs/meeting-picker](https://github.com/nodejs/meeting-picker) | [a2ad374](https://github.com/nodejs/meeting-picker/commit/a2ad374b844dffc54986b48c5e9bd53544046e21) | 4.7 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/meeting-picker/compare/a2ad374b844dffc54986b48c5e9bd53544046e21/a2ad374b844dffc54986b48c5e9bd53544046e21) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/meeting-picker/commit/a2ad374b844dffc54986b48c5e9bd53544046e21) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/meeting-picker) | +| [nodejs/undici](https://github.com/nodejs/undici) | [7cc4fcf](https://github.com/nodejs/undici/commit/7cc4fcf71275a700a62b16c7df335243b0563a6f) | 8.3 | 2025-11-04T10:26:46Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/undici/compare/4bcde3e916cb8cd81e5009e32eaf782889ec957b/7cc4fcf71275a700a62b16c7df335243b0563a6f) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/undici/commit/7cc4fcf71275a700a62b16c7df335243b0563a6f) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/undici) | +| [nodejs/official-images](https://github.com/nodejs/official-images) | [9e49b7d](https://github.com/nodejs/official-images/commit/9e49b7d2201238df6457a446a2573cd2fc7fa189) | 3.7 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/official-images/compare/9e49b7d2201238df6457a446a2573cd2fc7fa189/9e49b7d2201238df6457a446a2573cd2fc7fa189) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/official-images/commit/9e49b7d2201238df6457a446a2573cd2fc7fa189) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/official-images) | +| [nodejs/package-maintenance](https://github.com/nodejs/package-maintenance) | [4257d53](https://github.com/nodejs/package-maintenance/commit/4257d53e63041f84ac439c1d4f83f873138cdc51) | 6.5 | 2025-10-27 | 0.3 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/package-maintenance/compare/d596a7ee8b6ce4d39a135cc5b1e8ddab011d1825/4257d53e63041f84ac439c1d4f83f873138cdc51) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/package-maintenance/commit/4257d53e63041f84ac439c1d4f83f873138cdc51) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/package-maintenance) | +| [nodejs/uvwasi](https://github.com/nodejs/uvwasi) | [cbd1962](https://github.com/nodejs/uvwasi/commit/cbd1962f851c0ca7e62c2875affe0c4dee68e4ac) | 7.1 | 2025-10-27 | 0.5 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/uvwasi/compare/94a9f59482ef1747c65564cb40a9c162e03f1e00/cbd1962f851c0ca7e62c2875affe0c4dee68e4ac) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/uvwasi/commit/cbd1962f851c0ca7e62c2875affe0c4dee68e4ac) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/uvwasi) | +| [nodejs/corepack](https://github.com/nodejs/corepack) | [7e0758e](https://github.com/nodejs/corepack/commit/7e0758e4fd920859ad92adf204caf766b242f1af) | 5.9 | 2025-10-27 | 0.4 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/corepack/compare/57bfb67b062ea1b8746b302bcdbf9f8e8438c526/7e0758e4fd920859ad92adf204caf766b242f1af) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/corepack/commit/7e0758e4fd920859ad92adf204caf766b242f1af) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/corepack) | +| [nodejs/gyp-next](https://github.com/nodejs/gyp-next) | [6341ec0](https://github.com/nodejs/gyp-next/commit/6341ec05248de52a9c7d61ef6a6e8f6ceed72ca1) | 6.9 | 2025-10-27 | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/gyp-next/compare/94c13e077944f84dcd62e4861ea565c141af2067/6341ec05248de52a9c7d61ef6a6e8f6ceed72ca1) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/gyp-next/commit/6341ec05248de52a9c7d61ef6a6e8f6ceed72ca1) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/gyp-next) | | [nodejs/node-auto-test](https://github.com/nodejs/node-auto-test) | [b85939c](https://github.com/nodejs/node-auto-test/commit/b85939c0dc88670c1d3fbed36b5aba01e2c3f4c7) | 5.9 | 2023-04-17T09:08:01Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-auto-test/compare/b85939c0dc88670c1d3fbed36b5aba01e2c3f4c7/b85939c0dc88670c1d3fbed36b5aba01e2c3f4c7) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/node-auto-test/commit/b85939c0dc88670c1d3fbed36b5aba01e2c3f4c7) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/node-auto-test) | -| [nodejs/api-docs-tooling](https://github.com/nodejs/api-docs-tooling) | [440da36](https://github.com/nodejs/api-docs-tooling/commit/440da3604e1e3507af3bbb86607fadeb566e5afc) | 8.7 | 2025-06-05T13:35:41Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/api-docs-tooling/compare/b3d756187a24e88a5f9e1143a5490889cd67d6d2/440da3604e1e3507af3bbb86607fadeb566e5afc) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/api-docs-tooling/commit/440da3604e1e3507af3bbb86607fadeb566e5afc) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/api-docs-tooling) | -| [nodejs/amaro](https://github.com/nodejs/amaro) | [40a7cc9](https://github.com/nodejs/amaro/commit/40a7cc9137eb6636b6d775d87b1d9cf8a6473e99) | 6.9 | 2025-06-03T07:28:52Z | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/amaro/compare/b57b09c168d0f54012d0529b682804e9124d3362/40a7cc9137eb6636b6d775d87b1d9cf8a6473e99) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/amaro/commit/40a7cc9137eb6636b6d775d87b1d9cf8a6473e99) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/amaro) | +| [nodejs/api-docs-tooling](https://github.com/nodejs/api-docs-tooling) | [9436edd](https://github.com/nodejs/api-docs-tooling/commit/9436edd798f6b7a96765e7154c16131f2153dd53) | 8.6 | 2025-07-17T17:50:49Z | 0 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/api-docs-tooling/compare/0d6d689bf8458e6ad542352c915dfa4a4b413e32/9436edd798f6b7a96765e7154c16131f2153dd53) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/api-docs-tooling/commit/9436edd798f6b7a96765e7154c16131f2153dd53) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/api-docs-tooling) | +| [nodejs/amaro](https://github.com/nodejs/amaro) | [9b58426](https://github.com/nodejs/amaro/commit/9b58426d45df80d42499c1b2ad3b59140ce8b532) | 7.2 | 2025-11-04T07:28:12Z | 0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/amaro/compare/594f836d15900864e4313f48687321ecd41f9130/9b58426d45df80d42499c1b2ad3b59140ce8b532) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/amaro/commit/9b58426d45df80d42499c1b2ad3b59140ce8b532) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/amaro) | +| [nodejs/web-team](https://github.com/nodejs/web-team) | [c421732](https://github.com/nodejs/web-team/commit/c421732ffed193f88239c2fd3f6aac081328311f) | 8.7 | 2025-11-04T07:28:13Z | 0.2 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/web-team/compare/1ca4b8093b7fc399b63368857543004862fc93e1/c421732ffed193f88239c2fd3f6aac081328311f) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/web-team/commit/c421732ffed193f88239c2fd3f6aac081328311f) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/web-team) | +| [nodejs/doc-kit](https://github.com/nodejs/doc-kit) | [b799808](https://github.com/nodejs/doc-kit/commit/b7998083882a981d06710e7c6681e69ffd73535c) | 8.6 | 2025-11-04T12:12:53Z | -0.1 / [Details](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/doc-kit/compare/4c6ffae6e9c4c5ed6193324ecce4fab524ce8dbe/b7998083882a981d06710e7c6681e69ffd73535c) | [View](https://ossf.github.io/scorecard-visualizer/#/projects/github.com/nodejs/doc-kit/commit/b7998083882a981d06710e7c6681e69ffd73535c) | [Fix it](https://app.stepsecurity.io/securerepo?repo=nodejs/doc-kit) | _Report generated by [OpenSSF Scorecard Monitor](https://github.com/ossf/scorecard-monitor)._ diff --git a/tools/ossf_scorecard/scope.json b/tools/ossf_scorecard/scope.json index a3f99edb8..22e2f4562 100644 --- a/tools/ossf_scorecard/scope.json +++ b/tools/ossf_scorecard/scope.json @@ -37,7 +37,9 @@ "gyp-next", "node-auto-test", "api-docs-tooling", - "amaro" + "amaro", + "web-team", + "doc-kit" ], "excluded": [ "node-addon-examples", diff --git a/tools/vex/.gitignore b/tools/vex/.gitignore new file mode 100644 index 000000000..799dcaa12 --- /dev/null +++ b/tools/vex/.gitignore @@ -0,0 +1 @@ +node-vex-generator diff --git a/tools/vex/README.md b/tools/vex/README.md new file mode 100644 index 000000000..a12605826 --- /dev/null +++ b/tools/vex/README.md @@ -0,0 +1,28 @@ +# Node.js OpenVEX Generator + +This tool produces a single OpenVEX document (`node.openvex.json`) covering: + +* Node.js Core vulnerabilities (`vuln/core/index.json`). +* Bundled npm-related vulnerabilities (`vuln/npm/index.json`). +* Dependency that we believe do **not** affect Node.js (`vuln/deps/index.json`) - these are emitted with `status: not_affected`. + +## Output + +Run: + +``` +go run . +``` + +Generates `node.openvex.json`. + +## Adding / Updating Vulnerabilities + +1. Edit the appropriate index file under `vuln/`. +2. Run `go run .` to regenerate. + +**Note:** Entries without a CVE ID are skipped and will not appear in the generated VEX document. + +## Do Not Manually Edit Generated File + +`node.openvex.json` is generated; modify source indices instead. diff --git a/tools/vex/go.mod b/tools/vex/go.mod new file mode 100644 index 000000000..a112d23af --- /dev/null +++ b/tools/vex/go.mod @@ -0,0 +1,12 @@ +module node-vex-generator + +go 1.23.5 + +require ( + github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/openvex/go-vex v0.2.5 // indirect + github.com/package-url/packageurl-go v0.1.1 // indirect + github.com/sirupsen/logrus v1.9.3 // indirect + golang.org/x/sys v0.8.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect +) diff --git a/tools/vex/go.sum b/tools/vex/go.sum new file mode 100644 index 000000000..6cba99218 --- /dev/null +++ b/tools/vex/go.sum @@ -0,0 +1,20 @@ +github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= +github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/openvex/go-vex v0.2.5 h1:41utdp2rHgAGCsG+UbjmfMG5CWQxs15nGqir1eRgSrQ= +github.com/openvex/go-vex v0.2.5/go.mod h1:j+oadBxSUELkrKh4NfNb+BPo77U3q7gdKME88IO/0Wo= +github.com/package-url/packageurl-go v0.1.1 h1:KTRE0bK3sKbFKAk3yy63DpeskU7Cvs/x/Da5l+RtzyU= +github.com/package-url/packageurl-go v0.1.1/go.mod h1:uQd4a7Rh3ZsVg5j0lNyAfyxIeGde9yrlhjF78GzeW0c= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= +github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.8.0 h1:EBmGv8NaZBZTWvrbjNoL6HVt+IVy3QDQpJs7VRIw3tU= +golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/tools/vex/main.go b/tools/vex/main.go new file mode 100644 index 000000000..f171091ea --- /dev/null +++ b/tools/vex/main.go @@ -0,0 +1,68 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" +) + +const outputFile = "node.openvex.json" + +func main() { + coreVulns, err := LoadVulnerabilities("../../vuln/core/index.json") + if err != nil { + fmt.Fprintf(os.Stderr, "Failed to load core vulnerabilities: %v\n", err) + os.Exit(1) + } + + npmVulns, err := LoadVulnerabilities("../../vuln/npm/index.json") + if err != nil { + fmt.Fprintf(os.Stderr, "Failed to load npm vulnerabilities: %v\n", err) + os.Exit(1) + } + + depsVulns, err := LoadVulnerabilities("../../vuln/deps/index.json") + if err != nil { + fmt.Fprintf(os.Stderr, "Warning: Failed to load deps vulnerabilities: %v\n", err) + depsVulns = make(map[string]VulnEntry) + } + + doc, err := GenerateVEXDocument("Node.js Security WG", "Project") + if err != nil { + fmt.Fprintf(os.Stderr, "Error generating VEX: %v\n", err) + os.Exit(1) + } + + doc.GenerateCanonicalID() + + fmt.Println("Validating OpenVEX spec compliance...") + if err := ValidateVEX(doc); err != nil { + fmt.Fprintf(os.Stderr, "OpenVEX validation failed: %v\n", err) + os.Exit(1) + } + + fmt.Println("Validating against source vulnerability data...") + if err := ValidateVEXAgainstSource(doc, coreVulns, npmVulns, depsVulns); err != nil { + fmt.Fprintf(os.Stderr, "Source validation failed: %v\n", err) + os.Exit(1) + } + + fmt.Println("All validations passed!") + + file, err := os.Create(outputFile) + if err != nil { + fmt.Fprintf(os.Stderr, "Failed to create file: %v\n", err) + os.Exit(1) + } + defer file.Close() + + encoder := json.NewEncoder(file) + encoder.SetIndent("", " ") + + if err := encoder.Encode(doc); err != nil { + fmt.Fprintf(os.Stderr, "Failed to encode VEX: %v\n", err) + os.Exit(1) + } + + fmt.Printf("VEX document written to %s\n", outputFile) +} diff --git a/tools/vex/node.openvex.json b/tools/vex/node.openvex.json new file mode 100644 index 000000000..09a9127cf --- /dev/null +++ b/tools/vex/node.openvex.json @@ -0,0 +1,3509 @@ +{ + "@context": "https://openvex.dev/ns/v0.2.0", + "@id": "https://openvex.dev/docs/public/vex-c457698bda4fafafdf6fa823b3db6d2d334d9bb331e0726f290325e2a06722bb", + "author": "Node.js Security WG", + "role": "Project", + "timestamp": "2026-06-26T21:22:10.5365226Z", + "version": 1, + "statements": [ + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2015-3193", + "name": "CVE-2015-3193", + "description": "An attack may be possible against a Node.js TLS server using DHE key exchange.\nDetails are available at \u003chttp://openssl.org/news/secadv/20151203.txt\u003e.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.1.1" + }, + { + "@id": "pkg:generic/nodejs/node@v4.2.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2015-3194", + "name": "CVE-2015-3194", + "description": "A potential denial-of-service vector for Node.js TLS servers using client\ncertificate authentication; TLS clients are also impacted. Details are available\nat \u003chttp://openssl.org/news/secadv/20151203.txt\u003e.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.1.1" + }, + { + "@id": "pkg:generic/nodejs/node@v4.2.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2015-6764", + "name": "CVE-2015-6764", + "description": "Backport fix for CVE-2015-6764, a bug in v8's `JSON.stringify()` that can result\nin out-of-bounds reads for arrays.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.1.1" + }, + { + "@id": "pkg:generic/nodejs/node@v4.2.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2015-7384", + "name": "CVE-2015-7384", + "description": "out-of-order 'finish' event bug in pipelining can abort execution" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.1.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2015-8027", + "name": "CVE-2015-8027", + "description": "A bug whereby an HTTP socket may no longer have a parser associated with it but\na pipelined request attempts to trigger a pause or resume on the non-existent\nparser, a potential denial-of-service vulnerability.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.1.1" + }, + { + "@id": "pkg:generic/nodejs/node@v4.2.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-0702", + "name": "CVE-2016-0702", + "description": "Fix a defect that makes the _[CacheBleed\nAttack](https://ssrg.nicta.com.au/projects/TS/cachebleed/)_ possible. This\ndefect enables attackers to execute side-channel attacks leading to the\npotential recovery of entire RSA private keys. It only affects the Intel Sandy\nBridge (and possibly older) microarchitecture when using hyper-threading. Newer\nmicroarchitectures, including Haswell, are unaffected.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.3.2" + }, + { + "@id": "pkg:generic/nodejs/node@v5.7.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-0797", + "name": "CVE-2016-0797", + "description": "Fix a defect that can cause memory corruption in certain very rare cases\nrelating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is\nbelieved that Node.js is not invoking the code paths that use these functions so\npractical attacks via Node.js using this defect are _unlikely_ to be possible.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.3.2" + }, + { + "@id": "pkg:generic/nodejs/node@v5.7.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-1669", + "name": "CVE-2016-1669", + "description": "Under certain conditions, V8 may improperly expand memory allocations in the\nZone::New function. This could potentially be used to cause a Denial of Service\nvia buffer overflow or as a trigger for a remote code execution.\n\nAlthough this bug is marked as high severity in the corresponding Chromium\nrelease (50.0.2661.102), our assessment is that this is low severity for\nNode.js users due to the level of difficulty in making use of this\nvulnerability. However, users are encouraged to upgrade their Node.js\ninstallation to ensure they are properly protected.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.4.6" + }, + { + "@id": "pkg:generic/nodejs/node@v5.12.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2086", + "name": "CVE-2016-2086", + "description": "Fix defects in HTTP header parsing for requests and responses that\ncan allow request smuggling (CVE-2016-2086).\n\nHTTP header parsing now aligns more closely with the HTTP spec\nincluding restricting the acceptable characters.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.6.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2105", + "name": "CVE-2016-2105", + "description": "An overflow can occur in the OpenSSL EVP_EncodeUpdate() function which is used\nfor Base64 encoding of binary data. An attacker must be able to supply large\namounts of input data in order to cause an overflow.\n\nNode.js uses the EVP_EncodeUpdate() internally during calls to\ncrypto.Certificate#exportPublicKey() for SPKAC Certificate Signing\nRequests. User-supplied data must be passed to this method for\napplications to be vulnerable. This method has been available since\nNode.js v0.12.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.4.4" + }, + { + "@id": "pkg:generic/nodejs/node@v5.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v6.1.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2107", + "name": "CVE-2016-2107", + "description": "A man-in-the-middle (MITM) attacker may be able to execute a padding oracle\nattack to decrypt traffic when a connection uses an AES-CBC cipher and the\nserver runs on an Intel CPU supporting AES-NI. This is a common configuration\nfor TLS servers.\n\nThe OpenSSL project has labelled this vulnerability high severity.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.4.4" + }, + { + "@id": "pkg:generic/nodejs/node@v5.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v6.1.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2178", + "name": "CVE-2016-2178", + "description": "A flaw in the OpenSSL DSA implementation means that a non-constant time codepath\nis followed for certain operations. This has been demonstrated through a\ncache-timing attack to be sufficient for an attacker to recover the private DSA\nkey.\n\nThis is very low severity for Node.js users due to the difficulty in taking\nadvantage of this attack and because DSA is very rarely used.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2183", + "name": "CVE-2016-2183", + "description": "SWEET32 is a new attack on older block cipher algorithms that use a block size\nof 64 bits.\n\nAs mitigation, OpenSSL has moved DES-based ciphers from the HIGH to MEDIUM\ngroup. As Node.js includes HIGH, but not MEDIUM, in its default suite, affected\nciphers are no longer included unless the default suite is not used. Node's\ndefault TLS cipher suite can be found in the API documentation.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-2216", + "name": "CVE-2016-2216", + "description": "Fix defects in HTTP header parsing for requests and responses that\ncan allow response splitting (CVE-2016-2216).\n\nHTTP header parsing now aligns more closely with the HTTP spec\nincluding restricting the acceptable characters.\n\nIntroduce new `--security-revert={cvenum}` command line flag for selective\nreversion of specific CVE fixes allow the fix for CVE-2016-2216 to be\nselectively reverted using `--security-revert=CVE-2016-2216`.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v5.6.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-5172", + "name": "CVE-2016-5172", + "description": "The V8 parser mishandled scopes, potentially allowing an attacker to obtain\nsensitive information from arbitrary memory locations via crafted JavaScript\ncode. This vulnerability would require an attacker to be able to execute\narbitrary JavaScript code in a Node.js process.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.9.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-5180", + "name": "CVE-2016-5180", + "description": "A security vulnerability has been discovered in the c-ares library that is\nbundled with all versions of Node.js. Due to the difficulty of triggering and\nmaking use of this vulnerability we currently consider this a low-severity\nsecurity flaw for Node.js users.\n\nMore information at https://c-ares.haxx.se/adv_20160929.html\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v0.10.48" + }, + { + "@id": "pkg:generic/nodejs/node@v0.12.17" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-5325", + "name": "CVE-2016-5325", + "description": "**http**: Properly validate for allowable characters in the `reason` argument in\n`ServerResponse#writeHead()`. Fixes a possible response splitting attack vector.\nThis introduces a new case where `throw` may occur when configuring HTTP\nresponses, users should already be adopting try/catch here.\n\nThis is a low severity security defect that that may make HTTP response\nsplitting possible under certain circumstances. If user-input is passed to the\nreason argument to writeHead() on an HTTP response, a new-line character may be\nused to inject additional responses.\n\nThe fix for this defect introduces a new case where throw may occur when\nconfiguring HTTP responses. Users should already be adopting try/catch here.\n\nCommon Vulnerability Scoring System (CVSS) v3 Base Score:\n\n\tMetric\tScore\n\tBase Score:\t4.8 (Medium)\n\tBase Vector:\tCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\tAttack Vector:\tNetwork (AV:N)\n\tAttack Complexity:\tHigh (AC:H)\n\tPrivileges Required:\tNone (PR:N)\n\tUser Interaction:\tNone (UI:N)\n\tScope of Impact:\tUnchanged (S:U)\n\tConfidentiality Impact:\tLow (C:L)\n\tIntegrity Impact:\tLow (I:L)\n\tAvailability Impact:\tNone (A:N)\n\nRefer to the\n[CVSS v3 Specification](https://www.first.org/cvss/specification-document)\nfor details on the meanings and application of the vector components.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-6303", + "name": "CVE-2016-6303", + "description": "An overflow can occur in MDC2_Update() under certain circumstances resulting in\nan out of bounds (OOB) error. This attack is impractical on most platforms due\nto the size of data required to trigger the OOB error.\n\nNode.js is impacted by this flaw but due to the impracticalities of exploiting\nit and the very low usage of of MDC-2, it is very low severity for Node.js\nusers.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-6304", + "name": "CVE-2016-6304", + "description": "A malicious client can exhaust a server's memory, resulting in a denial of\nservice (DoS) by sending very large OCSP Status Request extensions in a single\nsession.\n\nThis flaw is labelled high severity due to the ease of use for a DoS attack and\nNode.js servers using TLS are vulnerable.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-6306", + "name": "CVE-2016-6306", + "description": "Some missing message length checks can result in out of bounds (OOB) reads of up\nto 2 bytes beyond an allocated buffer. There is a theoretical denial of service\n(DoS) risk. This only impacts a client or a server which enables client\nauthentication.\n\nNode.js is impacted by this low severity flaw.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-7055", + "name": "CVE-2016-7055", + "description": "Some calculations, when run on an Intel Broadwell or later CPU, can produce in\nerroneous results. This flaw has been previously discussed by the Node.js team\non GitHub. It is not believed that practical attacks can be crafted to exploit\nthis vulnerability except in very specific circumstances. Therefore this is a\nlow severity flaw.\n\nAll active versions of Node.js are affected, but the severity is very low for\nNode.js users.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.7.3" + }, + { + "@id": "pkg:generic/nodejs/node@v6.9.5" + }, + { + "@id": "pkg:generic/nodejs/node@v7.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-7099", + "name": "CVE-2016-7099", + "description": "Fix invalid wildcard certificate validation check whereby a TLS server may be\nable to serve an invalid wildcard certificate for its hostname due to improper\nvalidation of `*.` in the wildcard string. \n\nThis is a high severity defect that would allow a malicious TLS server to serve\nan invalid wildcard certificate for its hostname and be improperly validated by\na Node.js client. This is due to a flaw in the validation of *. in the wildcard\nname string.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.7.0" + }, + { + "@id": "pkg:generic/nodejs/node@v4.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-9551", + "name": "CVE-2016-9551", + "description": "Please be aware that Node.js v7.2.0 was released today and includes a small\nsecurity update arising from libuv: https://nodejs.org/en/blog/release/v7.2.0/\n\nlibuv v1.10.1 reverts a change that was introduced in v1.10.0, included in\nNode.js v7.1.0. The reverted code was found to contain a potential buffer\noverflow in output written to the console. We are not aware of any exploit of\nthis flaw and it only impacts Windows 10 (November update and later). This flaw\nhas been assigned the identifier CVE-2016-9551 and was originally discovered and\nreported by Hitesh Kanwathirtha of Microsoft.\n\nUsers of the v7 release line running on Windows 10 should upgrade to Node.js\nv7.2.0 at their earliest convenience.\n\nNo other version of Node.js is known to be impacted by this flaw.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v7.2.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-9840", + "name": "CVE-2016-9840", + "description": "An upgrade to zlib 1.2.11 to fix a number of low severity CVEs\nthat were present in zlib 1.2.8.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.2" + }, + { + "@id": "pkg:generic/nodejs/node@v6.10.2" + }, + { + "@id": "pkg:generic/nodejs/node@v7.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-9841", + "name": "CVE-2016-9841", + "description": "An upgrade to zlib 1.2.11 to fix a number of low severity CVEs\nthat were present in zlib 1.2.8.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.2" + }, + { + "@id": "pkg:generic/nodejs/node@v6.10.2" + }, + { + "@id": "pkg:generic/nodejs/node@v7.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-9842", + "name": "CVE-2016-9842", + "description": "An upgrade to zlib 1.2.11 to fix a number of low severity CVEs\nthat were present in zlib 1.2.8.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.2" + }, + { + "@id": "pkg:generic/nodejs/node@v6.10.2" + }, + { + "@id": "pkg:generic/nodejs/node@v7.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2016-9843", + "name": "CVE-2016-9843", + "description": "An upgrade to zlib 1.2.11 to fix a number of low severity CVEs\nthat were present in zlib 1.2.8.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.2" + }, + { + "@id": "pkg:generic/nodejs/node@v6.10.2" + }, + { + "@id": "pkg:generic/nodejs/node@v7.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-1000381", + "name": "CVE-2017-1000381", + "description": "The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR\nresponses, could be triggered to read memory outside of the given input buffer\nif the passed in DNS response packet was crafted in a particular way.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.1.4" + }, + { + "@id": "pkg:generic/nodejs/node@v7.10.1" + }, + { + "@id": "pkg:generic/nodejs/node@v4.8.4" + }, + { + "@id": "pkg:generic/nodejs/node@v6.11.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-14849", + "name": "CVE-2017-14849", + "description": "Node.js version 8.5.0 included a change which caused a security vulnerability in the checks on paths made by some community modules. As a result, an attacker may be able to access file system paths other than those intended." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-14919", + "name": "CVE-2017-14919", + "description": "Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version) if you call zlib.createDeflateRaw({windowBits: 8})." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.5" + }, + { + "@id": "pkg:generic/nodejs/node@v6.11.5" + }, + { + "@id": "pkg:generic/nodejs/node@v8.8.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-15896", + "name": "CVE-2017-15896", + "description": "Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.8.7" + }, + { + "@id": "pkg:generic/nodejs/node@v6.12.2" + }, + { + "@id": "pkg:generic/nodejs/node@v8.9.3" + }, + { + "@id": "pkg:generic/nodejs/node@v9.2.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-15897", + "name": "CVE-2017-15897", + "description": "Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, \"This is not correctly encoded\", \"hex\");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.9.3" + }, + { + "@id": "pkg:generic/nodejs/node@v9.2.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-3731", + "name": "CVE-2017-3731", + "description": "This is a moderate severity flaw in OpenSSL. By default, Node.js disables RC4 so\nmost users are not affected. As RC4 can be enabled programmatically, it is\npossible for a Node.js developer to craft code that may be vulnerable to this\nflaw. Any user activating RC4 in their codebase should prioritise this update.\n\nAll active versions of Node.js are affected, but the severity is very low for\nmost users.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.7.3" + }, + { + "@id": "pkg:generic/nodejs/node@v6.9.5" + }, + { + "@id": "pkg:generic/nodejs/node@v7.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2017-3732", + "name": "CVE-2017-3732", + "description": "As noted by the OpenSSL team, the likelihood of being able to craft a practical\nattack that uses this flaw is very low. In addition, Node.js enables\nSSL_OP_SINGLE_DH_USE, further decreasing the chance of a successful exploit of\nthis vulnerability in a Node.js service.\n\nAll active versions of Node.js are affected, but the severity is very low for\nNode.js users.\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.7.3" + }, + { + "@id": "pkg:generic/nodejs/node@v6.9.5" + }, + { + "@id": "pkg:generic/nodejs/node@v7.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12115", + "name": "CVE-2018-12115", + "description": "When used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.14.4" + }, + { + "@id": "pkg:generic/nodejs/node@v8.11.4" + }, + { + "@id": "pkg:generic/nodejs/node@v\u003e= 10.9.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12116", + "name": "CVE-2018-12116", + "description": "HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.14.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12120", + "name": "CVE-2018-12120", + "description": "Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.14.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12121", + "name": "CVE-2018-12121", + "description": "Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v10.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v11.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12122", + "name": "CVE-2018-12122", + "description": "Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v10.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v11.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-12123", + "name": "CVE-2018-12123", + "description": "Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case \"javascript:\" (e.g. \"javAscript:\") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v10.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v11.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7158", + "name": "CVE-2018-7158", + "description": "The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.9.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7159", + "name": "CVE-2018-7159", + "description": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v4.9.0" + }, + { + "@id": "pkg:generic/nodejs/node@v6.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.11.0" + }, + { + "@id": "pkg:generic/nodejs/node@v9.10.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7160", + "name": "CVE-2018-7160", + "description": "The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.14.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.11.0" + }, + { + "@id": "pkg:generic/nodejs/node@v9.10.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7161", + "name": "CVE-2018-7161", + "description": "All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.11.3" + }, + { + "@id": "pkg:generic/nodejs/node@v9.11.2" + }, + { + "@id": "pkg:generic/nodejs/node@v10.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7162", + "name": "CVE-2018-7162", + "description": "All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v9.11.2" + }, + { + "@id": "pkg:generic/nodejs/node@v10.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7164", + "name": "CVE-2018-7164", + "description": "Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v9.11.2" + }, + { + "@id": "pkg:generic/nodejs/node@v10.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7166", + "name": "CVE-2018-7166", + "description": "An argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v\u003e= 10.9.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2018-7167", + "name": "CVE-2018-7167", + "description": "Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.14.3" + }, + { + "@id": "pkg:generic/nodejs/node@v8.11.3" + }, + { + "@id": "pkg:generic/nodejs/node@v9.11.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-15604", + "name": "CVE-2019-15604", + "description": "Remotely trigger an assertion on a TLS server with a malformed certificate string" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.19.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v13.8.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-15605", + "name": "CVE-2019-15605", + "description": "HTTP request smuggling using malformed Transfer-Encoding header" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.19.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v13.8.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-15606", + "name": "CVE-2019-15606", + "description": "HTTP header values do not have trailing OWS trimmed" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.19.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.15.0" + }, + { + "@id": "pkg:generic/nodejs/node@v13.8.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-5737", + "name": "CVE-2019-5737", + "description": "An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active release lines including 6, 8, 10 and 11." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v8.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.15.2" + }, + { + "@id": "pkg:generic/nodejs/node@v11.10.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-5739", + "name": "CVE-2019-5739", + "description": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v6.17.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9511", + "name": "CVE-2019-9511", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9512", + "name": "CVE-2019-9512", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9513", + "name": "CVE-2019-9513", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9514", + "name": "CVE-2019-9514", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9515", + "name": "CVE-2019-9515", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9516", + "name": "CVE-2019-9516", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9517", + "name": "CVE-2019-9517", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2019-9518", + "name": "CVE-2019-9518", + "description": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v8.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v10.16.3" + }, + { + "@id": "pkg:generic/nodejs/node@v12.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-1971", + "name": "CVE-2020-1971", + "description": "OpenSSL - EDIPARTYNAME NULL pointer de-reference - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.23.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.15.4" + }, + { + "@id": "pkg:generic/nodejs/node@v15.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-7774", + "name": "CVE-2020-7774", + "description": "This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.22.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8201", + "name": "CVE-2020-8201", + "description": "HTTP Request Smuggling due to CR-to-Hyphen conversion" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.18.4" + }, + { + "@id": "pkg:generic/nodejs/node@v14.11.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8251", + "name": "CVE-2020-8251", + "description": "Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.11.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8252", + "name": "CVE-2020-8252", + "description": "fs.realpath.native on may cause buffer overflow" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.22.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.18.4" + }, + { + "@id": "pkg:generic/nodejs/node@v14.9.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8265", + "name": "CVE-2020-8265", + "description": "use-after-free in TLSWrap - affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.23.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.15.4" + }, + { + "@id": "pkg:generic/nodejs/node@v15.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8277", + "name": "CVE-2020-8277", + "description": "Denial of Service through DNS request" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v15.2.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2020-8287", + "name": "CVE-2020-8287", + "description": "HTTP Request Smuggling in nodejs - Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.23.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.15.4" + }, + { + "@id": "pkg:generic/nodejs/node@v15.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22883", + "name": "CVE-2021-22883", + "description": "HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion - Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.21.0" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.0" + }, + { + "@id": "pkg:generic/nodejs/node@v15.10.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22884", + "name": "CVE-2021-22884", + "description": "DNS rebinding in --inspect - Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.21.0" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.0" + }, + { + "@id": "pkg:generic/nodejs/node@v15.10.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22918", + "name": "CVE-2021-22918", + "description": "Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.2" + }, + { + "@id": "pkg:generic/nodejs/node@v16.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22921", + "name": "CVE-2021-22921", + "description": "Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.2" + }, + { + "@id": "pkg:generic/nodejs/node@v16.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22930", + "name": "CVE-2021-22930", + "description": "Node.js before is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.4" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.4" + }, + { + "@id": "pkg:generic/nodejs/node@v16.6.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22931", + "name": "CVE-2021-22931", + "description": "Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22931" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.5" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.5" + }, + { + "@id": "pkg:generic/nodejs/node@v16.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22939", + "name": "CVE-2021-22939", + "description": "If the Node.js https API was used incorrectly and \"undefined\" was in passed for the \"rejectUnauthorized\" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22939" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.5" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.5" + }, + { + "@id": "pkg:generic/nodejs/node@v16.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22940", + "name": "CVE-2021-22940", + "description": "Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22940" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.5" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.5" + }, + { + "@id": "pkg:generic/nodejs/node@v16.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22959", + "name": "CVE-2021-22959", + "description": "The http parser accepts requests with a space (SP) right after the header name before the colon. The http parser ignores chunk extensions when parsing the body of chunked requests. These can lead to HTTP Request Smuggling (HRS). See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.7" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.11.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-22960", + "name": "CVE-2021-22960", + "description": "The http parser accepts requests with a space (SP) right after the header name before the colon. The http parser ignores chunk extensions when parsing the body of chunked requests. These can lead to HTTP Request Smuggling (HRS). See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.7" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.11.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-23362", + "name": "CVE-2021-23362", + "description": "This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-23840", + "name": "CVE-2021-23840", + "description": "OpenSSL - Integer overflow in CipherUpdate - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.0" + }, + { + "@id": "pkg:generic/nodejs/node@v12.21.0" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.0" + }, + { + "@id": "pkg:generic/nodejs/node@v15.10.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-27290", + "name": "CVE-2021-27290", + "description": "This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-3449", + "name": "CVE-2021-3449", + "description": "This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.22.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v15.14.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-3450", + "name": "CVE-2021-3450", + "description": "This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v10.24.1" + }, + { + "@id": "pkg:generic/nodejs/node@v12.22.1" + }, + { + "@id": "pkg:generic/nodejs/node@v14.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v15.14.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-37701", + "name": "CVE-2021-37701", + "description": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.6" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.6" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-37712", + "name": "CVE-2021-37712", + "description": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.6" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.6" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-37713", + "name": "CVE-2021-37713", + "description": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.6" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.6" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-39134", + "name": "CVE-2021-39134", + "description": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.6" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.6" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-39135", + "name": "CVE-2021-39135", + "description": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.6" + }, + { + "@id": "pkg:generic/nodejs/node@v14.17.6" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-44531", + "name": "CVE-2021-44531", + "description": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.9" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.13.2" + }, + { + "@id": "pkg:generic/nodejs/node@v17.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-44532", + "name": "CVE-2021-44532", + "description": "Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.9" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.13.2" + }, + { + "@id": "pkg:generic/nodejs/node@v17.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2021-44533", + "name": "CVE-2021-44533", + "description": "Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.9" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.13.2" + }, + { + "@id": "pkg:generic/nodejs/node@v17.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-0778", + "name": "CVE-2022-0778", + "description": "This is a vulnerability in OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates. More details are available at https://www.openssl.org/news/secadv/20220315.txt." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.11" + }, + { + "@id": "pkg:generic/nodejs/node@v14.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.14.2" + }, + { + "@id": "pkg:generic/nodejs/node@v17.7.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-21824", + "name": "CVE-2022-21824", + "description": "Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824 for more details." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v12.22.9" + }, + { + "@id": "pkg:generic/nodejs/node@v14.18.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.13.2" + }, + { + "@id": "pkg:generic/nodejs/node@v17.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32212", + "name": "CVE-2022-32212", + "description": "The IsAllowedHost check in https://github.com/nodejs/node/blob/fdf0a84e826d3a9ec0ce6f5a3f5adc967fe99408/src/inspector_socket.cc#L580 can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), the browser will make a DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server to perform a rebinding attack and hence access the JSON file containing the WebSocket file.\n The fix we introduced in https://hackerone.com/reports/1069487 was not complete." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32213", + "name": "CVE-2022-32213", + "description": "The llhttp parser in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS)." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32214", + "name": "CVE-2022-32214", + "description": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS)." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v16.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v18.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32215", + "name": "CVE-2022-32215", + "description": "The llhttp parser in the http module in Node does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS)." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32222", + "name": "CVE-2022-32222", + "description": "On linux, versions of 18.x prior to Y used a default path for openssl.cnf that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v16.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-32223", + "name": "CVE-2022-32223", + "description": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.\nThis vulnerability can be exploited if the victim has the following dependencies on a Windows machine:\n* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.\n\nWhenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.\nAfter that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.\n\nIt is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v16.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v18.5.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-35255", + "name": "CVE-2022-35255", + "description": "Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. However, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-35256", + "name": "CVE-2022-35256", + "description": "The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.9.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2022-43548", + "name": "CVE-2022-43548", + "description": "The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.1" + }, + { + "@id": "pkg:generic/nodejs/node@v16.18.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.12.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.0.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-23918", + "name": "CVE-2023-23918", + "description": "It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-23919", + "name": "CVE-2023-23919", + "description": "In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.2.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-23920", + "name": "CVE-2023-23920", + "description": "Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-23936", + "name": "CVE-2023-23936", + "description": "The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-24807", + "name": "CVE-2023-24807", + "description": "The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v14.21.3" + }, + { + "@id": "pkg:generic/nodejs/node@v16.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v19.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30581", + "name": "CVE-2023-30581", + "description": "The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30582", + "name": "CVE-2023-30582", + "description": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30583", + "name": "CVE-2023-30583", + "description": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30584", + "name": "CVE-2023-30584", + "description": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30585", + "name": "CVE-2023-30585", + "description": "Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30586", + "name": "CVE-2023-30586", + "description": "Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30587", + "name": "CVE-2023-30587", + "description": "A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector)." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30588", + "name": "CVE-2023-30588", + "description": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30589", + "name": "CVE-2023-30589", + "description": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-30590", + "name": "CVE-2023-30590", + "description": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v18.16.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32002", + "name": "CVE-2023-32002", + "description": "The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v18.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32003", + "name": "CVE-2023-32003", + "description": "fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32004", + "name": "CVE-2023-32004", + "description": "Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32005", + "name": "CVE-2023-32005", + "description": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32006", + "name": "CVE-2023-32006", + "description": "The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v18.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32558", + "name": "CVE-2023-32558", + "description": "The use of the deprecated API process.binding() can bypass the permission model through path traversal." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-32559", + "name": "CVE-2023-32559", + "description": "The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v16.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v18.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.5.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-38552", + "name": "CVE-2023-38552", + "description": "Integrity checks according to experimental policies can be circumvented (Medium)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-39331", + "name": "CVE-2023-39331", + "description": "A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations (High)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-39332", + "name": "CVE-2023-39332", + "description": "Path traversal through path stored in Uint8Array (High)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-39333", + "name": "CVE-2023-39333", + "description": "Code injection via WebAssembly export names (Low)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-44487", + "name": "CVE-2023-44487", + "description": "Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound causes denial of service (High)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-45143", + "name": "CVE-2023-45143", + "description": "Cookie headers are not cleared in cross-domain redirect in undici-fetch (High)" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.8.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-45853", + "name": "CVE-2023-45853", + "description": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_present", + "impact_statement": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2023-46809", + "name": "CVE-2023-46809", + "description": "A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-13176", + "name": "CVE-2024-13176", + "description": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-21890", + "name": "CVE-2024-21890", + "description": "Improper handling of wildcards in --allow-fs-read and --allow-fs-write" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-21891", + "name": "CVE-2024-21891", + "description": "Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-21892", + "name": "CVE-2024-21892", + "description": "Code injection and privilege escalation through Linux capabilities" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-21896", + "name": "CVE-2024-21896", + "description": "The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve()." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-22017", + "name": "CVE-2024-22017", + "description": "setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid()" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-22018", + "name": "CVE-2024-22018", + "description": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.lstat` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 22.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v22.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-22019", + "name": "CVE-2024-22019", + "description": "A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS)." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-22020", + "name": "CVE-2024-22020", + "description": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\n\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\n\nExploiting this flaw can violate network import security, posing a risk to developers and servers." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.4" + }, + { + "@id": "pkg:generic/nodejs/node@v20.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v22.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-22025", + "name": "CVE-2024-22025", + "description": "A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.19.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.6.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-27980", + "name": "CVE-2024-27980", + "description": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.12.2" + }, + { + "@id": "pkg:generic/nodejs/node@v21.7.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-27980", + "name": "CVE-2024-27980", + "description": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v20.12.2" + }, + { + "@id": "pkg:generic/nodejs/node@v21.7.3" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-27982", + "name": "CVE-2024-27982", + "description": "The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.12.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.7.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-27983", + "name": "CVE-2024-27983", + "description": "An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.1" + }, + { + "@id": "pkg:generic/nodejs/node@v20.12.1" + }, + { + "@id": "pkg:generic/nodejs/node@v21.7.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-3156", + "name": "CVE-2024-3156", + "description": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-3159", + "name": "CVE-2024-3159", + "description": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-36137", + "name": "CVE-2024-36137", + "description": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as `fs.fchown` or `fs.fchmod` can use a \"read-only\" file descriptor to change the owner and permissions of a file.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v22.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-36138", + "name": "CVE-2024-36138", + "description": "The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via `child_process.spawn` / `child_process.spawnSync`. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.\n\nThis vulnerability affects all users of `child_process.spawn` and `child_process.spawnSync` on Windows in all active release lines." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.4" + }, + { + "@id": "pkg:generic/nodejs/node@v20.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v22.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-37372", + "name": "CVE-2024-37372", + "description": "The Permission Model assumes that any path starting with two backslashes \\\\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.\n\nThis vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v22.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-4761", + "name": "CVE-2024-4761", + "description": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-4947", + "name": "CVE-2024-4947", + "description": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-5274", + "name": "CVE-2024-5274", + "description": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2024-7535", + "name": "CVE-2024-7535", + "description": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23083", + "name": "CVE-2025-23083", + "description": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.13.1" + }, + { + "@id": "pkg:generic/nodejs/node@v23.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23084", + "name": "CVE-2025-23084", + "description": "A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.\n\nOn Windows, a path that does not start with the file separator is treated as relative to the current directory. \n\nThis vulnerability affects Windows users of `path.join` API.\n\n\n\n\n\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.6" + }, + { + "@id": "pkg:generic/nodejs/node@v20.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.13.1" + }, + { + "@id": "pkg:generic/nodejs/node@v23.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23085", + "name": "CVE-2025-23085", + "description": "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\n\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v18.20.6" + }, + { + "@id": "pkg:generic/nodejs/node@v20.18.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.13.1" + }, + { + "@id": "pkg:generic/nodejs/node@v23.6.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23165", + "name": "CVE-2025-23165", + "description": "In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.19.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.15.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23166", + "name": "CVE-2025-23166", + "description": " The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.19.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.15.1" + }, + { + "@id": "pkg:generic/nodejs/node@v23.11.1" + }, + { + "@id": "pkg:generic/nodejs/node@v24.0.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-23167", + "name": "CVE-2025-23167", + "description": "A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\\r\\n\\rX` instead of the required `\\r\\n\\r\\n`.\nThis inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.\n\nThe issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.\n\nImpact:\n* This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.19.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-27209", + "name": "CVE-2025-27209", + "description": "The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\n\n* This vulnerability affects Node.js v24.x users." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v24.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-27210", + "name": "CVE-2025-27210", + "description": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \n\nThis vulnerability affects Windows users of `path.join` API." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.19.4" + }, + { + "@id": "pkg:generic/nodejs/node@v22.17.1" + }, + { + "@id": "pkg:generic/nodejs/node@v24.4.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-55130", + "name": "CVE-2025-55130", + "description": "A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + }, + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-55131", + "name": "CVE-2025-55131", + "description": "A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + }, + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-55132", + "name": "CVE-2025-55132", + "description": "A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + }, + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-59464", + "name": "CVE-2025-59464", + "description": "A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-59465", + "name": "CVE-2025-59465", + "description": "A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket =\u003e {\n socket.on('error', err =\u003e {\n console.log(err)\n })\n})\n```" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + }, + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-59466", + "name": "CVE-2025-59466", + "description": "We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.0" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.13.0" + }, + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-9230", + "name": "CVE-2025-9230", + "description": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-9231", + "name": "CVE-2025-9231", + "description": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2025-9232", + "name": "CVE-2025-9232", + "description": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node" + } + ], + "status": "not_affected", + "justification": "vulnerable_code_not_in_execute_path", + "impact_statement": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths." + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21636", + "name": "CVE-2026-21636", + "description": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v25.3.0" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21637", + "name": "CVE-2026-21637", + "description": "A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.\n\nWhen an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.\n\n* This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21710", + "name": "CVE-2026-21710", + "description": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\n\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\n\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** " + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21711", + "name": "CVE-2026-21711", + "description": "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\n\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\n\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21712", + "name": "CVE-2026-21712", + "description": "A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.\n\n* This vulnerability affects **24.x and 25.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21713", + "name": "CVE-2026-21713", + "description": "A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\n\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21714", + "name": "CVE-2026-21714", + "description": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21715", + "name": "CVE-2026-21715", + "description": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21716", + "name": "CVE-2026-21716", + "description": "An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-21717", + "name": "CVE-2026-21717", + "description": "A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\n\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v20.20.2" + }, + { + "@id": "pkg:generic/nodejs/node@v22.22.2" + }, + { + "@id": "pkg:generic/nodejs/node@v24.14.1" + }, + { + "@id": "pkg:generic/nodejs/node@v25.8.2" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48615", + "name": "CVE-2026-48615", + "description": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\n\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48617", + "name": "CVE-2026-48617", + "description": "A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48618", + "name": "CVE-2026-48618", + "description": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48619", + "name": "CVE-2026-48619", + "description": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48928", + "name": "CVE-2026-48928", + "description": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48930", + "name": "CVE-2026-48930", + "description": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48931", + "name": "CVE-2026-48931", + "description": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48933", + "name": "CVE-2026-48933", + "description": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\n" + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48934", + "name": "CVE-2026-48934", + "description": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48935", + "name": "CVE-2026-48935", + "description": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + }, + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48936", + "name": "CVE-2026-48936", + "description": "A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.\n\nThis vulnerability affects one supported release line: **Node.js 26**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v26.3.1" + } + ], + "status": "fixed" + }, + { + "vulnerability": { + "@id": "https://www.cve.org/CVERecord?id=CVE-2026-48937", + "name": "CVE-2026-48937", + "description": "A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.\n\nThis vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**." + }, + "products": [ + { + "@id": "pkg:generic/nodejs/node@v22.23.0" + }, + { + "@id": "pkg:generic/nodejs/node@v24.17.0" + } + ], + "status": "fixed" + } + ] +} diff --git a/tools/vex/validator.go b/tools/vex/validator.go new file mode 100644 index 000000000..51c81a6b3 --- /dev/null +++ b/tools/vex/validator.go @@ -0,0 +1,176 @@ +// Validation checks: +// 1. OpenVEX spec compliance (structure, required fields, valid status values) +// 2. Source data accuracy (CVE existence, correct status, matching versions) +package main + +import ( + "errors" + "fmt" + "strings" + + "github.com/openvex/go-vex/pkg/vex" +) + +func ValidateVEX(doc *vex.VEX) error { + if doc == nil { + return errors.New("nil document") + } + if len(doc.Statements) == 0 { + return errors.New("no statements present") + } + + for i, s := range doc.Statements { + if s.Vulnerability.ID == "" { + return fmt.Errorf("statement %d missing vulnerability ID", i) + } + if len(s.Products) == 0 { + return fmt.Errorf("statement %d has no products", i) + } + + switch s.Status { + case vex.StatusNotAffected, vex.StatusAffected, vex.StatusFixed, vex.StatusUnderInvestigation: + default: + return fmt.Errorf("statement %d has invalid status: %s", i, s.Status) + } + + if err := validateStatementByStatus(&s, i); err != nil { + return err + } + } + + return nil +} + +func validateStatementByStatus(stmt *vex.Statement, index int) error { + switch stmt.Status { + case vex.StatusFixed: + for _, p := range stmt.Products { + if !strings.Contains(p.Component.ID, "@v") { + return fmt.Errorf("statement %d: fixed status requires version-specific products, got: %s", index, p.Component.ID) + } + } + + case vex.StatusNotAffected: + if stmt.Justification == "" && stmt.ImpactStatement == "" { + return fmt.Errorf("statement %d: not_affected status requires justification or impact_statement", index) + } + // If a justification is provided, ensure it is a valid OpenVEX justification. + if stmt.Justification != "" && !stmt.Justification.Valid() { + return fmt.Errorf("statement %d: invalid justification value: %s", index, stmt.Justification) + } + } + + return nil +} + +func ValidateVEXAgainstSource(doc *vex.VEX, coreVulns, npmVulns, depsVulns map[string]VulnEntry) error { + cveToEntry := make(map[string]*VulnEntry) + cveIsFromDeps := make(map[string]bool) + + for _, entry := range coreVulns { + entryCopy := entry + for _, cve := range entry.CVE { + cveToEntry[cve] = &entryCopy + cveIsFromDeps[cve] = false + } + } + + for _, entry := range npmVulns { + entryCopy := entry + for _, cve := range entry.CVE { + cveToEntry[cve] = &entryCopy + cveIsFromDeps[cve] = false + } + } + + for _, entry := range depsVulns { + entryCopy := entry + for _, cve := range entry.CVE { + cveToEntry[cve] = &entryCopy + cveIsFromDeps[cve] = true + } + } + + vexCVEs := make(map[string]bool) + + for i, stmt := range doc.Statements { + cveName := string(stmt.Vulnerability.Name) + vexCVEs[cveName] = true + + sourceEntry, exists := cveToEntry[cveName] + if !exists { + return fmt.Errorf("statement %d: CVE %s not found in source vulnerability data", i, cveName) + } + + isFromDeps := cveIsFromDeps[cveName] + + if err := validateStatus(stmt, *sourceEntry, isFromDeps, i); err != nil { + return err + } + + if stmt.Status == vex.StatusFixed { + if err := validateFixedProducts(stmt, *sourceEntry, i); err != nil { + return err + } + } + + if stmt.Vulnerability.Description == "" { + return fmt.Errorf("statement %d: missing vulnerability description for %s", i, cveName) + } + } + + for cve, entry := range cveToEntry { + if !cveIsFromDeps[cve] && entry.Patched != "" { + if !vexCVEs[cve] { + return fmt.Errorf("missing VEX statement for patched vulnerability: %s", cve) + } + } + } + + return nil +} + +func validateStatus(stmt vex.Statement, source VulnEntry, isFromDeps bool, index int) error { + if isFromDeps { + if stmt.Status != vex.StatusNotAffected { + return fmt.Errorf("statement %d: deps vulnerability should have not_affected status, got: %s", index, stmt.Status) + } + } else { + if source.Patched != "" { + if stmt.Status != vex.StatusFixed { + return fmt.Errorf("statement %d: vulnerability with patches should have fixed status, got: %s", index, stmt.Status) + } + } + } + + return nil +} + +func validateFixedProducts(stmt vex.Statement, source VulnEntry, index int) error { + expectedVersions := ExtractPatchedVersions(source.Patched) + + if len(stmt.Products) != len(expectedVersions) { + return fmt.Errorf("statement %d: expected %d products (patched versions), got %d", + index, len(expectedVersions), len(stmt.Products)) + } + + expectedMap := make(map[string]bool) + for _, ver := range expectedVersions { + expectedMap[ver] = true + } + + for _, product := range stmt.Products { + parts := strings.Split(product.Component.ID, "@") + if len(parts) != 2 { + return fmt.Errorf("statement %d: invalid product ID format: %s", index, product.Component.ID) + } + + version := parts[1] + if !expectedMap[version] { + return fmt.Errorf("statement %d: unexpected version %s, not in patched list: %s", + index, version, source.Patched) + } + } + + return nil +} diff --git a/tools/vex/vex_generator.go b/tools/vex/vex_generator.go new file mode 100644 index 000000000..ed9c658ff --- /dev/null +++ b/tools/vex/vex_generator.go @@ -0,0 +1,234 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" + "strings" + "time" + + "github.com/openvex/go-vex/pkg/vex" +) + +const ( + nodejsProductPURL = "pkg:generic/nodejs/node" + cveRecordBaseURL = "https://www.cve.org/CVERecord" +) + +// VulnEntry represents the structure of vulnerability entries in the index JSON files. +type VulnEntry struct { + CVE []string `json:"cve"` + Description string `json:"description"` + Overview string `json:"overview"` + Vulnerable string `json:"vulnerable"` + Patched string `json:"patched"` + Ref string `json:"ref"` + Severity string `json:"severity"` + AffectedEnvironments []string `json:"affectedEnvironments"` + Reason string `json:"reason"` +} + +// ExtractPatchedVersions parses semver range strings from the patched field. +// Input like "^8.1.4 || ^7.10.1" returns ["v8.1.4", "v7.10.1"]. +func ExtractPatchedVersions(patchedRange string) []string { + if patchedRange == "" { + return nil + } + + var versions []string + parts := strings.Split(patchedRange, "||") + + for _, part := range parts { + part = strings.TrimSpace(part) + if part == "" { + continue + } + + part = strings.TrimPrefix(part, "^") + part = strings.TrimPrefix(part, "~") + part = strings.TrimSpace(part) + + if part != "" { + if !strings.HasPrefix(part, "v") { + part = "v" + part + } + versions = append(versions, part) + } + } + + return versions +} + +// CreateProductsForVersions builds VEX product entries from version strings. +func CreateProductsForVersions(versions []string) []vex.Product { + products := make([]vex.Product, 0, len(versions)) + for _, ver := range versions { + products = append(products, vex.Product{ + Component: vex.Component{ + ID: fmt.Sprintf("%s@%s", nodejsProductPURL, ver), + }, + }) + } + return products +} + +// GenerateVEXDocument builds an OpenVEX document from vulnerability data in +// core, npm, and deps index files. +func GenerateVEXDocument(author, role string) (*vex.VEX, error) { + doc := vex.New() + doc.Author = author + doc.AuthorRole = role + now := time.Now().UTC() + doc.Timestamp = &now + + fmt.Println("Loading core vulnerabilities...") + coreVulns, err := LoadVulnerabilities("../../vuln/core/index.json") + if err != nil { + return nil, fmt.Errorf("load core vulns: %w", err) + } + + fmt.Println("Loading npm vulnerabilities...") + npmVulns, err := LoadVulnerabilities("../../vuln/npm/index.json") + if err != nil { + return nil, fmt.Errorf("load npm vulns: %w", err) + } + + fmt.Println("Generating VEX statements...") + if err := ProcessVulnerabilities(&doc, coreVulns); err != nil { + return nil, fmt.Errorf("process core vulns: %w", err) + } + if err := ProcessVulnerabilities(&doc, npmVulns); err != nil { + return nil, fmt.Errorf("process npm vulns: %w", err) + } + + fmt.Println("Loading deps vulnerabilities...") + depsVulns, err := LoadVulnerabilities("../../vuln/deps/index.json") + if err == nil { + if err := ProcessDepsVulnerabilities(&doc, depsVulns); err != nil { + return nil, fmt.Errorf("process deps vulns: %w", err) + } + } + + fmt.Printf("Generated %d VEX statements\n", len(doc.Statements)) + return &doc, nil +} + +// LoadVulnerabilities reads a JSON vulnerability index file. +func LoadVulnerabilities(path string) (map[string]VulnEntry, error) { + f, err := os.Open(path) + if err != nil { + return nil, err + } + defer f.Close() + + var vulns map[string]VulnEntry + if err := json.NewDecoder(f).Decode(&vulns); err != nil { + return nil, err + } + + return vulns, nil +} + +// ProcessVulnerabilities creates fixed-status VEX statements for patched vulnerabilities. +// Each statement includes the specific versions where the fix was released. +func ProcessVulnerabilities(doc *vex.VEX, vulns map[string]VulnEntry) error { + for _, entry := range vulns { + if len(entry.CVE) == 0 { + continue + } + + patchedVersions := ExtractPatchedVersions(entry.Patched) + + for _, cveID := range entry.CVE { + vuln := vex.Vulnerability{ + Name: vex.VulnerabilityID(cveID), + Description: firstNonEmpty(entry.Overview, entry.Description), + } + if strings.HasPrefix(cveID, "CVE-") { + vuln.ID = fmt.Sprintf("%s?id=%s", cveRecordBaseURL, cveID) + } + + if len(patchedVersions) == 0 { + return fmt.Errorf("vulnerability %s has no patched versions - all vulnerabilities must have fixes", cveID) + } + + products := CreateProductsForVersions(patchedVersions) + stmt := vex.Statement{ + Vulnerability: vuln, + Products: products, + Status: vex.StatusFixed, + } + + doc.Statements = append(doc.Statements, stmt) + } + } + + return nil +} + +// ProcessDepsVulnerabilities creates not_affected statements for dependency +// vulnerabilities that don't impact Node.js. +func ProcessDepsVulnerabilities(doc *vex.VEX, vulns map[string]VulnEntry) error { + for id, entry := range vulns { + if len(entry.CVE) == 0 { + continue + } + + if err := validateJustification(entry.Reason, id); err != nil { + return err + } + + for _, cveID := range entry.CVE { + vuln := vex.Vulnerability{ + Name: vex.VulnerabilityID(cveID), + Description: firstNonEmpty(entry.Overview, entry.Description), + } + if strings.HasPrefix(cveID, "CVE-") { + vuln.ID = fmt.Sprintf("%s?id=%s", cveRecordBaseURL, cveID) + } + + justification := mapReasonToJustification(entry.Reason) + + stmt := vex.Statement{ + Vulnerability: vuln, + Products: []vex.Product{ + {Component: vex.Component{ID: nodejsProductPURL}}, + }, + Status: vex.StatusNotAffected, + Justification: justification, + } + + if entry.Overview != "" { + stmt.ImpactStatement = entry.Overview + } + + doc.Statements = append(doc.Statements, stmt) + } + } + + return nil +} + +// mapReasonToJustification converts the reason field to OpenVEX justification. +func mapReasonToJustification(reason string) vex.Justification { + return vex.Justification(reason) +} + +// validateJustification checks if the reason is a valid OpenVEX justification +// using the VEX library's validation. +func validateJustification(reason, id string) error { + justification := vex.Justification(reason) + if !justification.Valid() { + return fmt.Errorf("invalid justification '%s' in deps entry %s - must be a valid OpenVEX justification", reason, id) + } + return nil +} + +func firstNonEmpty(vals ...string) string { + for _, v := range vals { + if v != "" { + return v + } + } + return "" +} diff --git a/tools/vuln_valid/vulnValidate.js b/tools/vuln_valid/vulnValidate.js index 4d03b4ca0..a65f4c34c 100644 --- a/tools/vuln_valid/vulnValidate.js +++ b/tools/vuln_valid/vulnValidate.js @@ -25,8 +25,7 @@ const coreModel = Joi.object({ publish_date: Joi .string() .regex(/^\d{4}-\d{2}-\d{2}$/) - .optional() - .isoDate(), + .optional(), type: Joi.string().optional(), cvss_score: Joi.number().optional(), cvss: Joi.string().optional(), @@ -43,9 +42,32 @@ const coreModel = Joi.object({ .required() }); +const npmModel = Joi.object({ + id: Joi.number().required(), + cves: Joi.array().items(Joi.string().regex(/CVE-\d{4}-\d+/)).required(), + created_at: Joi.string().regex(/^\d{4}-\d{2}-\d{2}$/).required(), + updated_at: Joi.string().regex(/^\d{4}-\d{2}-\d{2}$/).required(), + title: Joi.string().max(150).regex(/^[^\n]+$/).required(), + author: Joi.object({ + name: Joi.string().required(), + username: Joi.string().required().allow(null), + website: Joi.string().required().allow(null) + }), + module_name: Joi.string().required(), + publish_date: Joi.string().regex(/^\d{4}-\d{2}-\d{2}$/).required(), + vulnerable_versions: Joi.string().allow(null).required(), + patched_versions: Joi.string().allow(null).required(), + overview: Joi.string().required(), + recommendation: Joi.string().allow(null).required(), + references: Joi.array().allow(null).required(), + cvss_vector: Joi.string().allow(null).required(), + cvss_score: Joi.number().allow(null).required(), + coordinating_vendor: Joi.string().allow(null).required() +}); + function validateVuln(filePath, model) { const vuln = JSON.parse(fs.readFileSync(filePath)); - const result = coreModel.validate(vuln); + const result = model.validate(vuln); if (result.error) { console.error(filePath, result.error); throw result.error; @@ -64,6 +86,7 @@ function validate(dir, model) { module.exports = { coreModel, + npmModel, validateVuln, validate }; diff --git a/vuln/core/1.json b/vuln/core/1.json index 389be01bd..5c844b9fb 100644 --- a/vuln/core/1.json +++ b/vuln/core/1.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/10.json b/vuln/core/10.json index 8b3c24841..3ee7cbe63 100644 --- a/vuln/core/10.json +++ b/vuln/core/10.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/118.json b/vuln/core/118.json index 11608d71a..6aa88f0b8 100644 --- a/vuln/core/118.json +++ b/vuln/core/118.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/119.json b/vuln/core/119.json index aea83a35a..9076008fa 100644 --- a/vuln/core/119.json +++ b/vuln/core/119.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/12.json b/vuln/core/12.json index f4589a955..12246657c 100644 --- a/vuln/core/12.json +++ b/vuln/core/12.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/120.json b/vuln/core/120.json index 193d9d022..528670c48 100644 --- a/vuln/core/120.json +++ b/vuln/core/120.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/121.json b/vuln/core/121.json index 9475c6f38..316ae4291 100644 --- a/vuln/core/121.json +++ b/vuln/core/121.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/122.json b/vuln/core/122.json index 00858fa7f..4ceed9565 100644 --- a/vuln/core/122.json +++ b/vuln/core/122.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/123.json b/vuln/core/123.json index 4537104b4..78e71aa10 100644 --- a/vuln/core/123.json +++ b/vuln/core/123.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/124.json b/vuln/core/124.json index 40d50d5d4..6f6f1149f 100644 --- a/vuln/core/124.json +++ b/vuln/core/124.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/13.json b/vuln/core/13.json index c1276fbd8..bdda2f8c9 100644 --- a/vuln/core/13.json +++ b/vuln/core/13.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/138.json b/vuln/core/138.json index a3e451bb0..e404c35f2 100644 --- a/vuln/core/138.json +++ b/vuln/core/138.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/14.json b/vuln/core/14.json index 8aa8859c9..994f0714f 100644 --- a/vuln/core/14.json +++ b/vuln/core/14.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/141.json b/vuln/core/141.json index fff6e926c..d5f637cba 100644 --- a/vuln/core/141.json +++ b/vuln/core/141.json @@ -1,13 +1,14 @@ { "cve": [ - "CVE-2024-27982" + "CVE-2024-27980" ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.20.2 || ^20.12.2 || ^21.7.3", - "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2/", + "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2", + "description": "Command injection via args parameter of child_process.spawn without shell option enabled on Windows", "overview": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.", "affectedEnvironments": [ "win32" ], - "severity": "medium" + "severity": "high" } diff --git a/vuln/core/15.json b/vuln/core/15.json index c06a23bfc..9da731dfc 100644 --- a/vuln/core/15.json +++ b/vuln/core/15.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/154.json b/vuln/core/154.json new file mode 100644 index 000000000..e582d944a --- /dev/null +++ b/vuln/core/154.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-27210" + ], + "vulnerable": "20.x || 22.x || 24.x", + "patched": "^20.19.4 || ^22.17.1 || ^24.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/", + "description": "Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()", + "overview": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \n\nThis vulnerability affects Windows users of `path.join` API.", + "affectedEnvironments": [ + "win32" + ], + "severity": "high" +} diff --git a/vuln/core/155.json b/vuln/core/155.json new file mode 100644 index 000000000..dce073b65 --- /dev/null +++ b/vuln/core/155.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-27209" + ], + "vulnerable": "24.x", + "patched": "^24.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/", + "description": "HashDoS in V8", + "overview": "The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\n\n* This vulnerability affects Node.js v24.x users.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/156.json b/vuln/core/156.json new file mode 100644 index 000000000..843f90ccf --- /dev/null +++ b/vuln/core/156.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-55130" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "FS Permissions Bypass", + "overview": "A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/157.json b/vuln/core/157.json new file mode 100644 index 000000000..1548e151a --- /dev/null +++ b/vuln/core/157.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-55131" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled", + "overview": "A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/158.json b/vuln/core/158.json new file mode 100644 index 000000000..01af91141 --- /dev/null +++ b/vuln/core/158.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-55132" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "fs.futimes() Bypasses Read-Only Permission Model", + "overview": "A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/159.json b/vuln/core/159.json new file mode 100644 index 000000000..988645b83 --- /dev/null +++ b/vuln/core/159.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-59464" + ], + "vulnerable": "20.x || 22.x || 24.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Memory leak that enables remote Denial of Service against applications processing TLS client certificates", + "overview": "A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/16.json b/vuln/core/16.json index d34b8e59d..e1a5d6199 100644 --- a/vuln/core/16.json +++ b/vuln/core/16.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/160.json b/vuln/core/160.json new file mode 100644 index 000000000..9408020aa --- /dev/null +++ b/vuln/core/160.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-59465" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame", + "overview": "A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/161.json b/vuln/core/161.json new file mode 100644 index 000000000..fa6851fbb --- /dev/null +++ b/vuln/core/161.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2025-59466" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers", + "overview": "We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/162.json b/vuln/core/162.json new file mode 100644 index 000000000..452252bf0 --- /dev/null +++ b/vuln/core/162.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21636" + ], + "vulnerable": "25.x", + "patched": "^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)", + "overview": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.\n", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/163.json b/vuln/core/163.json new file mode 100644 index 000000000..7895eb4aa --- /dev/null +++ b/vuln/core/163.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21637" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS", + "overview": "A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.\n\nWhen an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.\n\n* This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/164.json b/vuln/core/164.json new file mode 100644 index 000000000..9a5fbc82f --- /dev/null +++ b/vuln/core/164.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21710" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)", + "overview": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\n\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\n\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** ", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/165.json b/vuln/core/165.json new file mode 100644 index 000000000..cd99be4d4 --- /dev/null +++ b/vuln/core/165.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21711" + ], + "vulnerable": "25.x", + "patched": "^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`", + "overview": "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\n\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\n\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/166.json b/vuln/core/166.json new file mode 100644 index 000000000..1c4fa2b02 --- /dev/null +++ b/vuln/core/166.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21712" + ], + "vulnerable": "24.x || 25.x", + "patched": "^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Assertion error in node_url.cc via malformed URL format leads to Node.js crash", + "overview": "A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.\n\n* This vulnerability affects **24.x and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/167.json b/vuln/core/167.json new file mode 100644 index 000000000..eac99c03b --- /dev/null +++ b/vuln/core/167.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21713" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery", + "overview": "A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\n\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/168.json b/vuln/core/168.json new file mode 100644 index 000000000..d05e8e02c --- /dev/null +++ b/vuln/core/168.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21714" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion", + "overview": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/169.json b/vuln/core/169.json new file mode 100644 index 000000000..e0131ac5b --- /dev/null +++ b/vuln/core/169.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21715" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Permission Model Bypass in realpathSync.native Allows File Existence Disclosure", + "overview": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/170.json b/vuln/core/170.json new file mode 100644 index 000000000..5b4158186 --- /dev/null +++ b/vuln/core/170.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21716" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown", + "overview": "An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/171.json b/vuln/core/171.json new file mode 100644 index 000000000..7c56f61df --- /dev/null +++ b/vuln/core/171.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-21717" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "HashDoS in V8", + "overview": "A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\n\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/172.json b/vuln/core/172.json new file mode 100644 index 000000000..db804b7c5 --- /dev/null +++ b/vuln/core/172.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48615" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Proxy credentials leaked in ERR_PROXY_TUNNEL error message", + "overview": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\n\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/173.json b/vuln/core/173.json new file mode 100644 index 000000000..655d29bf0 --- /dev/null +++ b/vuln/core/173.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48617" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Permission Model Bypass via `process.report.writeReport()` Path Misvalidation", + "overview": "A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/174.json b/vuln/core/174.json new file mode 100644 index 000000000..b65f02e95 --- /dev/null +++ b/vuln/core/174.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48618" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat", + "overview": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/175.json b/vuln/core/175.json new file mode 100644 index 000000000..e4c6d5b1c --- /dev/null +++ b/vuln/core/175.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48619" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames", + "overview": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/176.json b/vuln/core/176.json new file mode 100644 index 000000000..cafe5a2c6 --- /dev/null +++ b/vuln/core/176.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48937" + ], + "vulnerable": "22.x || 24.x", + "patched": "^22.23.0 || ^24.17.0", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors", + "overview": "A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.\n\nThis vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/177.json b/vuln/core/177.json new file mode 100644 index 000000000..06c3cce52 --- /dev/null +++ b/vuln/core/177.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48928" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching", + "overview": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/178.json b/vuln/core/178.json new file mode 100644 index 000000000..c5b2d04a9 --- /dev/null +++ b/vuln/core/178.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48930" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings", + "overview": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/179.json b/vuln/core/179.json new file mode 100644 index 000000000..c2a998b0d --- /dev/null +++ b/vuln/core/179.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48934" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections", + "overview": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/18.json b/vuln/core/18.json index cf6a1c2e5..5e83d682f 100644 --- a/vuln/core/18.json +++ b/vuln/core/18.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/180.json b/vuln/core/180.json new file mode 100644 index 000000000..ee1a80b14 --- /dev/null +++ b/vuln/core/180.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48935" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Permission Model bypass via FileHandle.utimes() in the promises API", + "overview": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/181.json b/vuln/core/181.json new file mode 100644 index 000000000..88c063b56 --- /dev/null +++ b/vuln/core/181.json @@ -0,0 +1,20 @@ +{ + "cve": [ + "CVE-2026-48936" + ], + "vulnerable": "26.x", + "patched": "^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)", + "overview": "A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.\n\nThis vulnerability affects one supported release line: **Node.js 26**.", + "affectedEnvironments": [ + "aix", + "darwin", + "freebsd", + "linux", + "openbsd", + "sunos", + "android" + ], + "severity": "low" +} diff --git a/vuln/core/182.json b/vuln/core/182.json new file mode 100644 index 000000000..ca96572cc --- /dev/null +++ b/vuln/core/182.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48931" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`", + "overview": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" +} diff --git a/vuln/core/183.json b/vuln/core/183.json new file mode 100644 index 000000000..87fea83f0 --- /dev/null +++ b/vuln/core/183.json @@ -0,0 +1,14 @@ +{ + "cve": [ + "CVE-2026-48933" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)", + "overview": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\n", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/19.json b/vuln/core/19.json index fdd965714..34ab23973 100644 --- a/vuln/core/19.json +++ b/vuln/core/19.json @@ -11,5 +11,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/22.json b/vuln/core/22.json index ec1317e47..5c7e052d6 100644 --- a/vuln/core/22.json +++ b/vuln/core/22.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/23.json b/vuln/core/23.json index beb014032..7be208cc1 100644 --- a/vuln/core/23.json +++ b/vuln/core/23.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/24.json b/vuln/core/24.json index da6480668..2ce36f0c1 100644 --- a/vuln/core/24.json +++ b/vuln/core/24.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/27.json b/vuln/core/27.json index 66ab659bc..99d0aa47a 100644 --- a/vuln/core/27.json +++ b/vuln/core/27.json @@ -8,5 +8,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/28.json b/vuln/core/28.json index 626d9671a..402283a00 100644 --- a/vuln/core/28.json +++ b/vuln/core/28.json @@ -8,5 +8,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/3.json b/vuln/core/3.json index bc1ae455a..2931433ac 100644 --- a/vuln/core/3.json +++ b/vuln/core/3.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/31.json b/vuln/core/31.json index 204c8e41e..ea6a495f0 100644 --- a/vuln/core/31.json +++ b/vuln/core/31.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/32.json b/vuln/core/32.json index eb99cedea..18739a9d2 100644 --- a/vuln/core/32.json +++ b/vuln/core/32.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/34.json b/vuln/core/34.json index 0dc9927a3..4a8457e97 100644 --- a/vuln/core/34.json +++ b/vuln/core/34.json @@ -8,5 +8,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/35.json b/vuln/core/35.json index 323c226ca..1aaa34baa 100644 --- a/vuln/core/35.json +++ b/vuln/core/35.json @@ -8,5 +8,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/36.json b/vuln/core/36.json index bfd483bef..e7f46c701 100644 --- a/vuln/core/36.json +++ b/vuln/core/36.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/37.json b/vuln/core/37.json index e400347bb..f619e32c0 100644 --- a/vuln/core/37.json +++ b/vuln/core/37.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/4.json b/vuln/core/4.json index da0f164d2..54822a9d7 100644 --- a/vuln/core/4.json +++ b/vuln/core/4.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/40.json b/vuln/core/40.json index 61c57898a..87bbd1bc4 100644 --- a/vuln/core/40.json +++ b/vuln/core/40.json @@ -11,5 +11,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/42.json b/vuln/core/42.json index 5d334d16d..75dcdff17 100644 --- a/vuln/core/42.json +++ b/vuln/core/42.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/43.json b/vuln/core/43.json index 00df2fa3e..7bbce961c 100644 --- a/vuln/core/43.json +++ b/vuln/core/43.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/44.json b/vuln/core/44.json index c5b71eade..6d3fd6ac0 100644 --- a/vuln/core/44.json +++ b/vuln/core/44.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" } diff --git a/vuln/core/45.json b/vuln/core/45.json index 489f8f660..9137cad12 100644 --- a/vuln/core/45.json +++ b/vuln/core/45.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "low" } diff --git a/vuln/core/46.json b/vuln/core/46.json index 6a34962a0..823031f37 100644 --- a/vuln/core/46.json +++ b/vuln/core/46.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/47.json b/vuln/core/47.json index cdd1f0b17..0d1ba870b 100644 --- a/vuln/core/47.json +++ b/vuln/core/47.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/48.json b/vuln/core/48.json index c1b1f9ddc..1e911bed9 100644 --- a/vuln/core/48.json +++ b/vuln/core/48.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/49.json b/vuln/core/49.json index 02657f249..b00ccd906 100644 --- a/vuln/core/49.json +++ b/vuln/core/49.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/5.json b/vuln/core/5.json index 645514226..451bbf3b2 100644 --- a/vuln/core/5.json +++ b/vuln/core/5.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/50.json b/vuln/core/50.json index c792f0887..a770d0ab7 100644 --- a/vuln/core/50.json +++ b/vuln/core/50.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/51.json b/vuln/core/51.json index 4c7483e2c..78f65de34 100644 --- a/vuln/core/51.json +++ b/vuln/core/51.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/52.json b/vuln/core/52.json index 07c3090a8..a6a6d6b0c 100644 --- a/vuln/core/52.json +++ b/vuln/core/52.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/53.json b/vuln/core/53.json index c62afed4a..96c3c01bb 100644 --- a/vuln/core/53.json +++ b/vuln/core/53.json @@ -12,5 +12,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/54.json b/vuln/core/54.json index 760b79339..6a720eeb4 100644 --- a/vuln/core/54.json +++ b/vuln/core/54.json @@ -12,5 +12,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/55.json b/vuln/core/55.json index a67130d14..b4da2957c 100644 --- a/vuln/core/55.json +++ b/vuln/core/55.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/56.json b/vuln/core/56.json index f120d7fac..fb07e85ce 100644 --- a/vuln/core/56.json +++ b/vuln/core/56.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/57.json b/vuln/core/57.json index 711fbad50..01b05032b 100644 --- a/vuln/core/57.json +++ b/vuln/core/57.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/58.json b/vuln/core/58.json index 5d579ff84..25d2e8c06 100644 --- a/vuln/core/58.json +++ b/vuln/core/58.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/59.json b/vuln/core/59.json index 924e8170b..fc0d04b8e 100644 --- a/vuln/core/59.json +++ b/vuln/core/59.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/60.json b/vuln/core/60.json index ae220fab6..2f517ca2e 100644 --- a/vuln/core/60.json +++ b/vuln/core/60.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/61.json b/vuln/core/61.json index 82b99c94c..9563b6575 100644 --- a/vuln/core/61.json +++ b/vuln/core/61.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/62.json b/vuln/core/62.json index 209e9093b..44a7cf0d4 100644 --- a/vuln/core/62.json +++ b/vuln/core/62.json @@ -20,5 +20,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/63.json b/vuln/core/63.json index e4e40816b..c347326c9 100644 --- a/vuln/core/63.json +++ b/vuln/core/63.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/64.json b/vuln/core/64.json index 5082afa89..30a4064d5 100644 --- a/vuln/core/64.json +++ b/vuln/core/64.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" } diff --git a/vuln/core/65.json b/vuln/core/65.json index 90bf145d2..8bfdee186 100644 --- a/vuln/core/65.json +++ b/vuln/core/65.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/69.json b/vuln/core/69.json index e5b249082..317cce1ee 100644 --- a/vuln/core/69.json +++ b/vuln/core/69.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/7.json b/vuln/core/7.json index cf018ce5d..87575da9e 100644 --- a/vuln/core/7.json +++ b/vuln/core/7.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/72.json b/vuln/core/72.json index bbe093d81..4b33b3bda 100644 --- a/vuln/core/72.json +++ b/vuln/core/72.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" } diff --git a/vuln/core/74.json b/vuln/core/74.json index aec5f46ca..a0a5d20aa 100644 --- a/vuln/core/74.json +++ b/vuln/core/74.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/75.json b/vuln/core/75.json index 246e87fe3..a1890ba0a 100644 --- a/vuln/core/75.json +++ b/vuln/core/75.json @@ -9,5 +9,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/8.json b/vuln/core/8.json index db4b198f7..0c0467c18 100644 --- a/vuln/core/8.json +++ b/vuln/core/8.json @@ -10,5 +10,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" } diff --git a/vuln/core/87.json b/vuln/core/87.json index f14b1ea29..bf337035b 100644 --- a/vuln/core/87.json +++ b/vuln/core/87.json @@ -13,5 +13,5 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" } diff --git a/vuln/core/index.json b/vuln/core/index.json index 870589af0..24abee36d 100644 --- a/vuln/core/index.json +++ b/vuln/core/index.json @@ -11,7 +11,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "2": { "cve": [], @@ -36,7 +36,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "4": { "cve": [ @@ -50,7 +50,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "5": { "cve": [ @@ -64,7 +64,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "6": { "cve": [ @@ -95,7 +95,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "8": { "cve": [ @@ -109,7 +109,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" }, "9": { "cve": [], @@ -134,7 +134,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "11": { "cve": [], @@ -161,7 +161,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "13": { "cve": [ @@ -175,7 +175,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "14": { "cve": [ @@ -189,7 +189,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "15": { "cve": [ @@ -203,7 +203,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "16": { "cve": [ @@ -217,7 +217,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "17": { "cve": [], @@ -246,7 +246,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "19": { "cve": [ @@ -261,7 +261,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "20": { "cve": [], @@ -299,7 +299,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "23": { "cve": [ @@ -313,7 +313,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "24": { "cve": [ @@ -327,7 +327,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "25": { "cve": [], @@ -362,7 +362,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "28": { "cve": [ @@ -374,7 +374,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "29": { "cve": [], @@ -409,7 +409,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "32": { "cve": [ @@ -422,7 +422,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "33": { "cve": [], @@ -445,7 +445,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "35": { "cve": [ @@ -457,7 +457,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "36": { "cve": [ @@ -471,7 +471,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "37": { "cve": [ @@ -485,7 +485,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "38": { "cve": [], @@ -523,7 +523,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "41": { "cve": [], @@ -547,7 +547,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "43": { "cve": [ @@ -560,7 +560,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "44": { "cve": [ @@ -573,7 +573,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" }, "45": { "cve": [ @@ -586,7 +586,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "low" }, "46": { "cve": [ @@ -599,7 +599,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "47": { "cve": [ @@ -612,7 +612,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "48": { "cve": [ @@ -625,7 +625,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "49": { "cve": [ @@ -638,7 +638,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "50": { "cve": [ @@ -651,7 +651,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "51": { "cve": [ @@ -664,7 +664,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "52": { "cve": [ @@ -677,7 +677,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "53": { "cve": [ @@ -693,7 +693,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "54": { "cve": [ @@ -709,7 +709,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "55": { "cve": [ @@ -726,7 +726,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "56": { "cve": [ @@ -743,7 +743,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "57": { "cve": [ @@ -760,7 +760,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "58": { "cve": [ @@ -777,7 +777,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "59": { "cve": [ @@ -794,7 +794,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "60": { "cve": [ @@ -811,7 +811,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "61": { "cve": [ @@ -828,7 +828,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "62": { "cve": [ @@ -852,7 +852,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "63": { "cve": [ @@ -866,7 +866,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "64": { "cve": [ @@ -880,7 +880,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "critical" }, "65": { "cve": [ @@ -894,7 +894,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "66": { "cve": [ @@ -949,7 +949,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "70": { "cve": [ @@ -988,7 +988,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "73": { "cve": [ @@ -1014,7 +1014,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "75": { "cve": [ @@ -1027,7 +1027,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "76": { "cve": [ @@ -1187,7 +1187,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "88": { "cve": [ @@ -1591,7 +1591,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "119": { "cve": [ @@ -1604,7 +1604,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "120": { "cve": [ @@ -1617,7 +1617,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "121": { "cve": [ @@ -1630,7 +1630,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "122": { "cve": [ @@ -1643,7 +1643,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "high" }, "123": { "cve": [ @@ -1656,7 +1656,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "124": { "cve": [ @@ -1669,7 +1669,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "125": { "cve": [ @@ -1851,7 +1851,7 @@ "affectedEnvironments": [ "all" ], - "severity": "unknown" + "severity": "medium" }, "139": { "cve": [ @@ -1883,16 +1883,17 @@ }, "141": { "cve": [ - "CVE-2024-27982" + "CVE-2024-27980" ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.20.2 || ^20.12.2 || ^21.7.3", - "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2/", + "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2", + "description": "Command injection via args parameter of child_process.spawn without shell option enabled on Windows", "overview": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.", "affectedEnvironments": [ "win32" ], - "severity": "medium" + "severity": "high" }, "142": { "cve": [ @@ -2061,5 +2062,431 @@ "all" ], "severity": "medium" + }, + "154": { + "cve": [ + "CVE-2025-27210" + ], + "vulnerable": "20.x || 22.x || 24.x", + "patched": "^20.19.4 || ^22.17.1 || ^24.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/", + "description": "Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()", + "overview": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \n\nThis vulnerability affects Windows users of `path.join` API.", + "affectedEnvironments": [ + "win32" + ], + "severity": "high" + }, + "155": { + "cve": [ + "CVE-2025-27209" + ], + "vulnerable": "24.x", + "patched": "^24.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/", + "description": "HashDoS in V8", + "overview": "The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\n\n* This vulnerability affects Node.js v24.x users.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "156": { + "cve": [ + "CVE-2025-55130" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "FS Permissions Bypass", + "overview": "A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "157": { + "cve": [ + "CVE-2025-55131" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Timeout-based race conditions make Uint8Array/Buffer.alloc non-zerofilled", + "overview": "A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "158": { + "cve": [ + "CVE-2025-55132" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "fs.futimes() Bypasses Read-Only Permission Model", + "overview": "A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "159": { + "cve": [ + "CVE-2025-59464" + ], + "vulnerable": "20.x || 22.x || 24.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Memory leak that enables remote Denial of Service against applications processing TLS client certificates", + "overview": "A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "160": { + "cve": [ + "CVE-2025-59465" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Node.js HTTP/2 server crashes with unhandled error when receiving malformed HEADERS frame", + "overview": "A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "161": { + "cve": [ + "CVE-2025-59466" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.0 || ^22.22.0 || ^24.13.0 || ^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Uncatchable \"Maximum call stack size exceeded\" error on Node.js via async_hooks leads to process crashes bypassing error handlers", + "overview": "We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "162": { + "cve": [ + "CVE-2026-21636" + ], + "vulnerable": "25.x", + "patched": "^25.3.0", + "ref": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", + "description": "Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)", + "overview": "A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.\n\n* The issue affects users of the Node.js permission model on version v25.\n\nIn the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.\n", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "163": { + "cve": [ + "CVE-2026-21637" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Incomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoS", + "overview": "A flaw in Node.js TLS error handling leaves `SNICallback` invocations unprotected against synchronous exceptions, while the equivalent ALPN and PSK callbacks were already addressed in CVE-2026-21637. This represents an incomplete fix of that prior vulnerability.\n\nWhen an `SNICallback` throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception, crashing the Node.js process.\n\n* This vulnerability affects all Node.js versions that received the CVE-2026-21637 fix, including **20.x, 22.x, 24.x, and 25.x**, on any TLS server where `SNICallback` may throw on unexpected `servername` input.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "164": { + "cve": [ + "CVE-2026-21710" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)", + "overview": "A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\n\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`.\n\n* This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** ", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "165": { + "cve": [ + "CVE-2026-21711" + ], + "vulnerable": "25.x", + "patched": "^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`", + "overview": "A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\n\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\n\nThis vulnerability affects Node.js **25.x** processes using the Permission Model where `--allow-net` is intentionally omitted to restrict network access. Note that `--allow-net` is currently an experimental feature.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "166": { + "cve": [ + "CVE-2026-21712" + ], + "vulnerable": "24.x || 25.x", + "patched": "^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Assertion error in node_url.cc via malformed URL format leads to Node.js crash", + "overview": "A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid characters, crashing the Node.js process.\n\n* This vulnerability affects **24.x and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "167": { + "cve": [ + "CVE-2026-21713" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery", + "overview": "A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\n\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an intentional design decision.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "168": { + "cve": [ + "CVE-2026-21714" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion", + "overview": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\n\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "169": { + "cve": [ + "CVE-2026-21715" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "Permission Model Bypass in realpathSync.native Allows File Existence Disclosure", + "overview": "A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "170": { + "cve": [ + "CVE-2026-21716" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown", + "overview": "An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\n\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "171": { + "cve": [ + "CVE-2026-21717" + ], + "vulnerable": "20.x || 22.x || 24.x || 25.x", + "patched": "^20.20.2 || ^22.22.2 || ^24.14.1 || ^25.8.2", + "ref": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", + "description": "HashDoS in V8", + "overview": "A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\n\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\n\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "172": { + "cve": [ + "CVE-2026-48615" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Proxy credentials leaked in ERR_PROXY_TUNNEL error message", + "overview": "A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\n\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "173": { + "cve": [ + "CVE-2026-48617" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Permission Model Bypass via `process.report.writeReport()` Path Misvalidation", + "overview": "A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "174": { + "cve": [ + "CVE-2026-48618" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat", + "overview": "A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" + }, + "175": { + "cve": [ + "CVE-2026-48619" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames", + "overview": "A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "176": { + "cve": [ + "CVE-2026-48937" + ], + "vulnerable": "22.x || 24.x", + "patched": "^22.23.0 || ^24.17.0", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors", + "overview": "A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.\n\nThis vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "177": { + "cve": [ + "CVE-2026-48928" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching", + "overview": "A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "178": { + "cve": [ + "CVE-2026-48930" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings", + "overview": "A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "179": { + "cve": [ + "CVE-2026-48934" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections", + "overview": "A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" + }, + "180": { + "cve": [ + "CVE-2026-48935" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Permission Model bypass via FileHandle.utimes() in the promises API", + "overview": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "181": { + "cve": [ + "CVE-2026-48936" + ], + "vulnerable": "26.x", + "patched": "^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)", + "overview": "A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.\n\nThis vulnerability affects one supported release line: **Node.js 26**.", + "affectedEnvironments": [ + "aix", + "darwin", + "freebsd", + "linux", + "openbsd", + "sunos", + "android" + ], + "severity": "low" + }, + "182": { + "cve": [ + "CVE-2026-48931" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`", + "overview": "A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" + }, + "183": { + "cve": [ + "CVE-2026-48933" + ], + "vulnerable": "22.x || 24.x || 26.x", + "patched": "^22.23.0 || ^24.17.0 || ^26.3.1", + "ref": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases", + "description": "Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (DoS)", + "overview": "A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2GiB.\n\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.\n", + "affectedEnvironments": [ + "all" + ], + "severity": "high" } } \ No newline at end of file diff --git a/vuln/deps/1.json b/vuln/deps/1.json new file mode 100644 index 000000000..667e97c20 --- /dev/null +++ b/vuln/deps/1.json @@ -0,0 +1,9 @@ +{ + "cve": [ + "CVE-2023-45853" + ], + "description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.", + "overview": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/205", + "reason": "vulnerable_code_not_present" +} \ No newline at end of file diff --git a/vuln/deps/2.json b/vuln/deps/2.json new file mode 100644 index 000000000..3c0f36987 --- /dev/null +++ b/vuln/deps/2.json @@ -0,0 +1,9 @@ +{ + "cve": [ + "CVE-2024-7535" + ], + "description": "Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", + "overview": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/190", + "reason": "vulnerable_code_not_in_execute_path" +} \ No newline at end of file diff --git a/vuln/deps/3.json b/vuln/deps/3.json new file mode 100644 index 000000000..5faaa6f47 --- /dev/null +++ b/vuln/deps/3.json @@ -0,0 +1,11 @@ +{ + "cve": [ + "CVE-2024-4761", + "CVE-2024-4947", + "CVE-2024-5274" + ], + "description": "Out of bounds write in V8. Type Confusion in V8. Type confusion in V8 in Google Chrome.", + "overview": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/191", + "reason": "vulnerable_code_not_in_execute_path" +} \ No newline at end of file diff --git a/vuln/deps/4.json b/vuln/deps/4.json new file mode 100644 index 000000000..65d87f00b --- /dev/null +++ b/vuln/deps/4.json @@ -0,0 +1,10 @@ +{ + "cve": [ + "CVE-2024-3159", + "CVE-2024-3156" + ], + "description": "V8 vulnerabilities in JavaScript engine", + "overview": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/184", + "reason": "vulnerable_code_not_in_execute_path" +} \ No newline at end of file diff --git a/vuln/deps/5.json b/vuln/deps/5.json new file mode 100644 index 000000000..f2a7c9b9a --- /dev/null +++ b/vuln/deps/5.json @@ -0,0 +1,9 @@ +{ + "cve": [ + "CVE-2024-13176" + ], + "description": "OpenSSL security vulnerability", + "overview": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/201", + "reason": "vulnerable_code_not_in_execute_path" +} \ No newline at end of file diff --git a/vuln/deps/6.json b/vuln/deps/6.json new file mode 100644 index 000000000..69038074a --- /dev/null +++ b/vuln/deps/6.json @@ -0,0 +1,11 @@ +{ + "cve": [ + "CVE-2025-9230", + "CVE-2025-9231", + "CVE-2025-9232" + ], + "description": "OpenSSL security vulnerabilities", + "overview": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/213", + "reason": "vulnerable_code_not_in_execute_path" +} \ No newline at end of file diff --git a/vuln/deps/index.json b/vuln/deps/index.json new file mode 100644 index 000000000..5dab377ff --- /dev/null +++ b/vuln/deps/index.json @@ -0,0 +1,61 @@ +{ + "1": { + "cve": [ + "CVE-2023-45853" + ], + "description": "MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field.", + "overview": "This CVE was created for MiniZip (part of zlib/contrib/minizip), which is not used by Node.js. Node.js uses zlib for compression but does not use the MiniZip component where this vulnerability exists.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/205", + "reason": "vulnerable_code_not_present" + }, + "2": { + "cve": [ + "CVE-2024-7535" + ], + "description": "Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", + "overview": "This V8 vulnerability does not fall within Node.js's threat model. The vulnerable code path is not exposed through Node.js APIs and cannot be exploited in normal Node.js usage.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/190", + "reason": "vulnerable_code_not_in_execute_path" + }, + "3": { + "cve": [ + "CVE-2024-4761", + "CVE-2024-4947", + "CVE-2024-5274" + ], + "description": "Out of bounds write in V8. Type Confusion in V8. Type confusion in V8 in Google Chrome.", + "overview": "These V8 vulnerabilities do not fall within Node.js's threat model. The vulnerable code paths are not exposed through Node.js APIs.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/191", + "reason": "vulnerable_code_not_in_execute_path" + }, + "4": { + "cve": [ + "CVE-2024-3159", + "CVE-2024-3156" + ], + "description": "V8 vulnerabilities in JavaScript engine", + "overview": "These V8 vulnerabilities do not affect Node.js. The vulnerable functionality is not exposed in Node.js's implementation.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/184", + "reason": "vulnerable_code_not_in_execute_path" + }, + "5": { + "cve": [ + "CVE-2024-13176" + ], + "description": "OpenSSL security vulnerability", + "overview": "This OpenSSL vulnerability does not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code path.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/201", + "reason": "vulnerable_code_not_in_execute_path" + }, + "6": { + "cve": [ + "CVE-2025-9230", + "CVE-2025-9231", + "CVE-2025-9232" + ], + "description": "OpenSSL security vulnerabilities", + "overview": "These OpenSSL vulnerabilities do not affect Node.js. Node.js's usage of OpenSSL does not trigger the vulnerable code paths.", + "ref": "https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues/213", + "reason": "vulnerable_code_not_in_execute_path" + } +} \ No newline at end of file