CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 06:50 UTC)

What this means for you

This week: 5,445 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,445; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product node.js_project:node.js. Show all products

14 CVEs, showing 1 to 14

CVE	Severity	Title	Published
CVE-2018-12121	High 7.5	Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB… Assigned by nodejs	Nov 28, 2018
CVE-2018-12123	Medium 4.3	Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL… Assigned by nodejs	Nov 28, 2018
CVE-2018-12120	High 8.1	Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all… Assigned by nodejs	Nov 28, 2018
CVE-2018-12116	High 7.5	Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, t… Assigned by nodejs	Nov 28, 2018
CVE-2018-12122	High 7.5	Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTT… Assigned by nodejs	Nov 28, 2018
CVE-2018-12115	High 7.5	In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()`… Assigned by nodejs	Aug 21, 2018
CVE-2018-7166	High 7.5	In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. Assigned by nodejs	Aug 21, 2018
CVE-2018-7167	High 7.5	Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. Assigned by nodejs	Jun 13, 2018
CVE-2018-7164	High 7.5	Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM. Assigned by nodejs	Jun 13, 2018
CVE-2018-7162	High 7.5	All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. Assigned by nodejs	Jun 13, 2018
CVE-2018-7161	High 7.5	All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH. Assigned by nodejs	Jun 13, 2018
CVE-2018-7160	High 8.8	The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. Assigned by nodejs	May 17, 2018
CVE-2018-7159	Medium 5.3	The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. Assigned by nodejs	May 17, 2018
CVE-2018-7158	High 7.5	The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. Assigned by nodejs	May 17, 2018

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.