[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0EklucvtPwVOW-dg3AfcIxO15-Ae7XhLjQMrijUsdDI":3},{"product":4,"cycleMajor":14,"releases":15,"cves":24,"nextMajor":88,"indexable":89},{"id":5,"slug":6,"name":7,"category":8,"vendor":9,"description":10,"logo_url":11,"official_url":9,"synced_at":12,"created_at":13},"36752f1b-49ae-4055-8ef8-ab933f8f2804","nodejs","Node.js","language",null,"Developers rely on a robust and versatile runtime environment to execute JavaScript code outside the browser, which is where Node.js comes into play. Created to provide a cross-platform, open-source solution, Node.js has been a staple in the development community since its inception. The Node.js project is maintained by the Node.js Foundation, ensuring the continued growth and support of this widely-used language. With its ability to run on various operating systems, including Windows, Linux, Unix, and macOS, Node.js has become an essential tool for developers seeking to build scalable and high-performance applications.\n\nThe end-of-life landscape for Node.js is a critical aspect for developers to stay on top of, with a total of 26 versions released to date. Currently, 23 of these versions have reached their end-of-life, leaving only 3 active versions still receiving support. The latest stable version, 22.22.3, is among the active ones, but its time is limited, as version 22 is slated to expire on 2027-04-30. This follows the recent end-of-life date of version 25, which occurred on 2026-06-01. Staying informed about these expirations is crucial for developers to plan their projects and migrations accordingly.\n\nThe security of Node.js is also a key concern, with a total of 38 CVEs tracked to date. Of these, 5 are considered critical, highlighting the potential risks associated with using outdated or vulnerable versions. Notably, version 24 is the most affected, with 6 CVEs reported. To mitigate these risks, developers should prioritize keeping their Node.js environment up to date, ideally running the latest stable version. By doing so, they can ensure they have the latest security patches and features, reducing the likelihood of exploits and maintaining the integrity of their applications.","https:\u002F\u002Fcdn.simpleicons.org\u002Fnodedotjs","2026-10-07T02:00:12.129+00:00","2026-05-30T16:23:55.904463+00:00","5",[16],{"id":17,"product_id":5,"cycle":14,"release_date":18,"eol":19,"eol_boolean":9,"latest":20,"latest_release_date":21,"lts":22,"support":19,"created_at":23},"12ddd044-d5ba-4bf7-b633-a2bf96037c68","2015-10-30","2016-06-30","5.12.0","2016-06-23",false,"2026-05-30T16:28:22.141504+00:00",[25,33,41,47,54,60,66,74,80],{"cveId":26,"releaseId":17,"cycle":14,"description":27,"severity":28,"cvssScore":29,"epssScore":30,"inKev":22,"publishedAt":31,"url":32},"CVE-2026-21717","A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.\r\n\r\nThe most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.\r\n\r\n","MEDIUM",5.9,0.00268,"2026-03-30T20:16:20.01+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21717",{"cveId":34,"releaseId":17,"cycle":14,"description":35,"severity":36,"cvssScore":37,"epssScore":38,"inKev":22,"publishedAt":39,"url":40},"CVE-2026-21716","An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\r\n\r\nT","LOW",3.3,0.00149,"2026-03-30T20:16:19.873+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21716",{"cveId":42,"releaseId":17,"cycle":14,"description":43,"severity":36,"cvssScore":37,"epssScore":44,"inKev":22,"publishedAt":45,"url":46},"CVE-2026-21715","A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.",0.00158,"2026-03-30T20:16:19.703+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21715",{"cveId":48,"releaseId":17,"cycle":14,"description":49,"severity":28,"cvssScore":50,"epssScore":51,"inKev":22,"publishedAt":52,"url":53},"CVE-2026-21714","A memory leak occurs in Node.js HTTP\u002F2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.",5.3,0.00454,"2026-03-30T20:16:19.573+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21714",{"cveId":55,"releaseId":17,"cycle":14,"description":56,"severity":28,"cvssScore":29,"epssScore":57,"inKev":22,"publishedAt":58,"url":59},"CVE-2026-21713","A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolution timing measurements are possible, this behavior could be exploited as a timing oracle to infer HMAC values.\r\n\r\nNode.js already provides timing-safe comparison primitives used elsewhere in the codebase, indicating this is an oversight rather than an in",0.00385,"2026-03-30T20:16:19.397+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21713",{"cveId":61,"releaseId":17,"cycle":14,"description":62,"severity":28,"cvssScore":50,"epssScore":63,"inKev":22,"publishedAt":64,"url":65},"CVE-2026-21711","A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission checks, while all comparable network paths correctly enforce them.\r\n\r\nAs a result, code running under `--permission` without `--allow-net` can create and expose local IPC endpoints, allowing communication with other processes on the same host outside of the intended network restriction boundary.\r\n\r\nThis vulnerability affects Node.js **25.x** processes using the",0.00175,"2026-03-30T20:16:19.26+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21711",{"cveId":67,"releaseId":17,"cycle":14,"description":68,"severity":69,"cvssScore":70,"epssScore":71,"inKev":22,"publishedAt":72,"url":73},"CVE-2026-21710","A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`.\r\n\r\nWhen this occurs, `dest[\"__proto__\"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req","HIGH",7.5,0.25044,"2026-03-30T20:16:18.21+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21710",{"cveId":75,"releaseId":17,"cycle":14,"description":76,"severity":69,"cvssScore":70,"epssScore":77,"inKev":22,"publishedAt":78,"url":79},"CVE-2026-21637","A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client ca",0.01136,"2026-01-20T21:16:05.95+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21637",{"cveId":81,"releaseId":17,"cycle":14,"description":82,"severity":83,"cvssScore":84,"epssScore":85,"inKev":22,"publishedAt":86,"url":87},"CVE-2024-3566","A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.","CRITICAL",9.8,0.06883,"2024-04-10T16:15:16.083+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-3566","6",true]