nodejs

Disclosed vulnerabilities where the NVD names nodejs as an affected vendor, highest CVSS first.

1. CRITICAL 9.8CVE-2026-111497public PoC2026-10-22

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a…

   brotli · node.js · brotlicffi · .net · debian linux · istio

   AI risk analysis on Exploit-DB.ai →

2. HIGH 7.5CVE-2026-87018public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trust…

   undici

   AI risk analysis on Exploit-DB.ai →

3. HIGH 7.5CVE-2026-109869public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codi…

   undici

   AI risk analysis on Exploit-DB.ai →

4. HIGH 7.5CVE-2026-109855public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so…

   undici

   AI risk analysis on Exploit-DB.ai →

5. HIGH 7.4CVE-2026-109829public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original r…

   undici

   AI risk analysis on Exploit-DB.ai →

6. HIGH 7.4CVE-2026-109383public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, …

   undici

   AI risk analysis on Exploit-DB.ai →

7. MEDIUM 5.9CVE-2026-87029public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions thos…

   undici

   AI risk analysis on Exploit-DB.ai →

8. MEDIUM 5.9CVE-2026-109932public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or…

   undici

   AI risk analysis on Exploit-DB.ai →

9. MEDIUM 5.9CVE-2026-109924public PoC2026-10-15

   undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending mil…

   undici

   AI risk analysis on Exploit-DB.ai →

10. MEDIUM 5.9CVE-2026-109841public PoC2026-10-15

    undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI speci…

    undici

    AI risk analysis on Exploit-DB.ai →