DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2026-01-13
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-21637US | high7.5 | — | ||
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions t… | ||||
| CVE-2026-21636US | critical10.0 | Exploit | ||
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker… | ||||
| CVE-2025-59466US | high7.5 | — | ||
We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reachin… | ||||
| CVE-2025-59465US | — | — | ||
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely clos… | ||||
| CVE-2025-59464US | high7.5 | — | ||
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPe… | ||||
| CVE-2025-55132US | medium5.3OT elevated | — | ||
A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utime… | ||||
| CVE-2025-55131US | — | — | ||
A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific tim… | ||||
| CVE-2025-55130US | critical9.1 | Exploit | ||
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:1842 vom 2026-02-05external
- Red Hat Security Advisory RHSA-2026:1843 vom 2026-02-05external
- Red Hat Security Advisory RHSA-2026:2420 vom 2026-02-10external
- Red Hat Security Advisory RHSA-2026:2421 vom 2026-02-10external
- Red Hat Security Advisory RHSA-2026:2422 vom 2026-02-10external
- Red Hat Security Advisory RHSA-2026:2768 vom 2026-02-17external
- Red Hat Security Advisory RHSA-2026:2781 vom 2026-02-17external
- Red Hat Security Advisory RHSA-2026:2782 vom 2026-02-17external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan