Node.js — программная платформа, основанная на движке V8 (компилирующем JavaScript в машинный код)
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 24.22.2 | 24.22.2 | ||
| 24.22.1 | 24.22.1 | ||
| 24.22.0 | 24.22.0 | ||
| 24.21.0 | 24.21.0 | ||
| 24.20.0 | 24.20.0 | ||
| 24.19.0 | 24.19.0 | ||
| 24.18.1 | 24.18.1 | ||
| 24.18.0 | 24.18.0 | ||
| 24.17.0 | 24.17.0 | ||
| 24.16.0 | 24.16.0 |
Показывать по
Количество 1 296
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesyst ...
CVE-2026-56847
A flaw in Node.js Permission Model enforcement allows `trace_events.cr ...
CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
CVE-2026-56847
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
GHSA-777r-4cwx-g26v
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
GHSA-hw7r-7v27-7388
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
GHSA-qrq2-c54w-wgqm
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
BDU:2026-17787
Уязвимость реализации протокола HTTP/2 программной платформы Node.js, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2026-17792
Уязвимость реализации протокола HTTPS программной платформы Node.js, позволяющая нарушителю обойти существующие механизмы безопасности
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesyst ... | CVSS3: 8.4 | 0% Низкий | 3 месяца назад |
| CVE-2026-56847 A flaw in Node.js Permission Model enforcement allows `trace_events.cr ... | CVSS3: 6.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-56850 A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. | CVSS3: 4.4 | 0% Низкий | 3 месяца назад |
| CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. | CVSS3: 8.4 | 0% Низкий | 3 месяца назад |
| CVE-2026-56847 A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | CVSS3: 6.1 | 0% Низкий | 3 месяца назад |
| GHSA-777r-4cwx-g26v A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. | CVSS3: 4.1 | 0% Низкий | 3 месяца назад |
| GHSA-hw7r-7v27-7388 A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | CVSS3: 3.3 | 0% Низкий | 3 месяца назад |
| GHSA-qrq2-c54w-wgqm A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. | CVSS3: 7.5 | 0% Низкий | 3 месяца назад |
 | BDU:2026-17787 Уязвимость реализации протокола HTTP/2 программной платформы Node.js, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 7.5 | 1% Низкий | 3 месяца назад |
| BDU:2026-17792 Уязвимость реализации протокола HTTPS программной платформы Node.js, позволяющая нарушителю обойти существующие механизмы безопасности | CVSS3: 6.3 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу