Spremljamo ranljivosti v izdelkih največjih proizvajalcev, kot so Microsoft, Cisco, Fortinet, Citrix in drugi. Izberite proizvajalca za seznam njegovih aktivnih ranljivosti in naših člankov.
Nodejs: ranljivosti v zadnjem letu
| CVE | CVSS | EPSS | CISA KEV | Proizvajalec | Opis (NVD, angleško) |
|---|---|---|---|---|---|
| CVE-2026-111497 | 9,2 Kritično | 82,6 % | Aktivno izkoriščana od 27. 10. 2026 | 7-zip, Andybalholm, Anthropic, Apache | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a |
| CVE-2026-48930 | 9,8 Kritično | 0,3 % | – | Nodejs | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **No |
| CVE-2026-109383 | 9,1 Kritično | 0,2 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool, |
| CVE-2026-84961 | 9,1 Kritično | 0,2 % | – | Nodejs | undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIden |
| CVE-2026-109829 | 9,1 Kritično | 0,1 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original r |
| CVE-2026-58043 | 8,4 Visoko | 0,1 % | – | Nodejs | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the i |
| CVE-2026-109869 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more than five content codi |
| CVE-2026-109932 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket client, including the bundled WebSocket exposed by Node.js, can be driven to exhaust process memory by a malicious or |
| CVE-2026-109924 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource client can be driven to exhaust process memory by a malicious or compromised Server-Sent Events peer. By sending mil |
| CVE-2026-109855 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so |
| CVE-2026-87029 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions thos |
| CVE-2026-109841 | 7,5 Visoko | 0,3 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI speci |
| CVE-2026-87018 | 7,5 Visoko | 0,2 % | – | Nodejs | undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trust |
| CVE-2026-48618 | 6,5 Srednje | 3,1 % | – | Nodejs | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat. This can lead to confidentiality impact or bypass of th |
| CVE-2026-48931 | 3,7 Nizko | 0,3 % | – | Nodejs | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. |
| CVE-2026-21715 | 3,3 Nizko | 0,2 % | – | Nodejs | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with re |