DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2026-03-24
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service zu verursachen, Sicherheitsmaßnahmen zu umgehen und Informationen offenzulegen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-21717US | medium5.9 | Exploit | ||
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that ca… | ||||
| CVE-2026-21716US | —OT elevated | — | ||
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equ… | ||||
| CVE-2026-21715US | — | — | ||
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions c… | ||||
| CVE-2026-21714US | — | — | ||
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum valu… | ||||
| CVE-2026-21713US | — | — | ||
A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number… | ||||
| CVE-2026-21711US | — | — | ||
A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths… | ||||
| CVE-2026-21710US | — | Exploit | ||
A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`… | ||||
| CVE-2026-21712US | medium6.5 | — | ||
A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized domain name (IDN) containing invalid ch… | ||||
| CVE-2026-21637US | high7.5 | — | ||
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions t… | ||||
| CVE-2024-36137US | — | — | ||
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not oper… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-8339 vom 2026-04-19external
- Red Hat Security Advisory RHSA-2026:7080 vom 2026-04-08external
- Red Hat Security Advisory RHSA-2026:7123 vom 2026-04-08external
- Red Hat Security Advisory RHSA-2026:7302 vom 2026-04-09external
- Red Hat Security Advisory RHSA-2026:7310 vom 2026-04-09external
- Red Hat Security Advisory RHSA-2026:7350 vom 2026-04-10external
- Red Hat Security Advisory RHSA-2026:7670 vom 2026-04-13external
- Red Hat Security Advisory RHSA-2026:7675 vom 2026-04-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan