Node.js

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

3critical5high3medium0low

updated 2026-10-29

vulnerabilities (19)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-22017US	—	0.89% (59th)	Exploit	no fix	2024-03-19	2 versions
CVE-2024-3566US	critical9.8	6.83% (94th)	—	no fix	2024-04-10	≤ * ≤21.7.2
CVE-2023-32004US	high8.8	2.13% (82nd)	—	no fix	2023-08-15	≤ 20.5.0 ≤20.5.0
CVE-2023-32558US	high7.5	1.74% (78th)	—	no fix	2023-09-12	≤ 20.5.0 ≤20.5.0
CVE-2023-32002US	critical9.8OT elevated	1.61% (76th)	—	no fix	2023-08-21	3 versions
CVE-2023-32006US	high8.8OT elevated	1.54% (75th)	—	no fix	2023-08-15	3 versions
CVE-2024-27980US	—	1.40% (72nd)	—	no fix	2025-01-09	3 versions
CVE-2023-32005US	medium5.3	1.36% (72nd)	—	no fix	2023-09-12	≤ 20.5.0 ≤20.5.0
CVE-2024-21896US	critical9.8	1.26% (70th)	—	no fix	2024-02-20	2 versions
CVE-2024-21891US	high8.8	1.24% (69th)	—	no fix	2024-02-20	3 versions
CVE-2023-32003US	medium5.3	1.17% (67th)	—	no fix	2023-08-15	≤ 20.5.0 ≤20.5.0
CVE-2024-22020US	—	1.10% (66th)	—	no fix	2024-07-09	3 versions
CVE-2024-21890US	medium6.5	0.95% (61st)	—	no fix	2024-02-20	3 versions
CVE-2023-30587US	—	0.75% (55th)	—	20.3.1	2024-09-07	20.3.1 → 20.3.1
CVE-2023-30583US	—	0.72% (54th)	—	20.3.1	2024-09-07	20.3.1 → 20.3.1
CVE-2023-30582US	—	0.58% (48th)	—	20.3.1	2024-09-07	20.3.1 → 20.3.1
CVE-2024-21892US	high7.8	0.56% (47th)	—	no fix	2024-02-20	4 versions
CVE-2024-22018US	—	0.46% (40th)	—	no fix	2024-07-10	2 versions
CVE-2023-30584US	—	0.34% (28th)	—	20.3.1	2024-09-07	20.3.1 → 20.3.1

The flaw types (CWEs) most of these CVEs share.

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6 CVEs
CWE-275CWE-2755 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-264CWE-2644 CVEs
CWE-284Improper Access Control4 CVEs
CWE-311Missing Encryption of Sensitive Data2 CVEs
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.