[CVE-2026-111497 ] Published: Oct 21, 2026, 10:13:35 PM UTC
Brotli vulnerability
Critical(9.2) CISA KEV
Interessata Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Interessata
usn · nodejs · debian · bookworm; pypi · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Interessata
usn · nodejs · debian · bookworm; pypi · nodejs · debian · 12
[CVE-2026-106070 ] Published: Oct 23, 2026, 12:00:00 AM UTC
nodejs: CVE-2026-106070
Low(3.7) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm
[CVE-2026-106071 ] Published: Oct 23, 2026, 12:00:00 AM UTC
nodejs: CVE-2026-106071
Low(3.6) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm
[CVE-2026-106074 ] Published: Oct 22, 2026, 7:47:36 AM UTC
nodejs: CVE-2026-106074
Medium(4.8) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-105481 ] Published: Oct 22, 2026, 7:47:28 AM UTC
nodejs: CVE-2026-105481
Medium(6.5) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-106072 ] Published: Oct 22, 2026, 7:47:25 AM UTC
nodejs: CVE-2026-106072
Medium(6.7) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-106073 ] Published: Oct 22, 2026, 7:47:23 AM UTC
nodejs: CVE-2026-106073
Low(3.3) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-105482 ] Published: Oct 21, 2026, 12:00:00 AM UTC
nodejs: CVE-2026-105482
High(7.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-105483 ] Published: Oct 21, 2026, 12:00:00 AM UTC
nodejs: CVE-2026-105483
High(7.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 14
[CVE-2026-106069 ] Published: Oct 21, 2026, 12:00:00 AM UTC
nodejs: CVE-2026-106069
High(7.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto
Version impact unknown
dsa · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-48932 ] Published: Aug 12, 2026, 7:25:34 PM UTC
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the origi
Medium(5.6) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-56846 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
This vulnerability affects Node.js **24.x** and **22.x**.
High(7.5) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-56847 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.
This can lead to confidentiality impact or bypass of the
Medium(6.1) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-56848 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free.
This vulnerabili
High(7.5) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-56850 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client cer
Medium(4.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-58039 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.
This can lead to confidentiality impact or bypass of the intended se
Medium(4.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-58040 ] Published: Jul 29, 2026, 10:00:00 PM UTC
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934).
This vulnerability affects N
Medium(6.3) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 14
[CVE-2026-58041 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound w
Medium(5.3) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 14
[CVE-2026-58042 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records.
Repeated triggering of this condition can lead to denial of service.
Medium(5.9) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 18.20.4+dfsg-1~deb12u3, 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 12; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
[CVE-2026-58043 ] Published: Jul 29, 2026, 10:00:00 PM UTC
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.
Under `--permission`, an attacker who is granted access to one path can abuse bo
High(8.4) Sconosciuto Dettagli (2) 18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14
18.20.4+dfsg-1~deb12u2 · all · bookworm-security
Sconosciuto · Corretta: 20.19.2+dfsg-1+deb13u3, 24.19.0+dfsg+~cs24.13.3-1
Version impact unknown
nvd · nodejs · debian · bookworm; pypi · nodejs · debian · 13; pypi · nodejs · debian · 14