Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	4.8	CVE-2026-106074	A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... Executive summary This advisory covers many security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a Brotli decoder flaw the advisory says could lead to remote code execution. The advisory rates the highest severity issue as HIGH and says updated versions are available, with releases on or shortly after October 21, 2026. Users should upgrade to the fixed Node.js versions listed (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include DNS name truncation at NUL bytes, TLS hostname verification bypasses involving non-canonical IPv4 spellings and fullwidth digits, a Brotli decoder out-of-bounds write (CVE-2026-111497) that the advisory says can lead to remote code execution, keep-alive socket response confusion, predictable entropy caches in startup snapshots and SEAs, a ZipFile read after failed header validation, a Permission Model wildcard over-grant, and a Permission Model bypass through fs.realpathSync. Attack preconditions are described per issue, such as a certificate issued by a CA trusted by the client and a platform resolver like glibc for one TLS issue, or malformed Brotli input supplied to node:zlib. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, and the advisory does not state which specific versions are affected for each issue beyond the release lines named. Workarounds are not stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.3	CVE-2026-106073	A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks Executive summary This advisory covers multiple security flaws in Node.js across the 26.x, 24.x, and 22.x release lines, including issues that could let attackers bypass permission controls, spoof TLS certificate identities, or potentially run code through the Brotli decompressor. The advisory rates the highest severity issue as HIGH and says the Node.js project will release fixed versions on or shortly after October 21, 2026. Users should upgrade to the updated Node.js releases listed in the advisory (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include a NUL byte truncation in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, an out-of-bounds write in the bundled Brotli decoder that the advisory says can lead to remote code execution, a keep-alive socket response-injection issue, a crypto entropy cache saved into snapshots, a ZipFile prefix-bytes issue, a wildcard radix lookup over-grant in the Permission Model, and a fs.realpathSync permission bypass. Attack preconditions are described per issue, such as an application resolving attacker-influenced hostnames, a certificate issued by a trusted CA for numeric DNS SANs, or a permission model with restricted --allow-fs-read. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, but the advisory does not state which specific version fixes each individual issue. Workarounds and detection guidance for these issues are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.7	CVE-2026-106072	A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... Executive summary This advisory covers CVE-2026-106072, a flaw in Node.js TLS hostname verification that can let a certificate meant for a DNS name be accepted for certain IP address spellings. The advisory rates the highest severity in this release as HIGH and covers several other Node.js issues in the same security release, but it does not give a severity for CVE-2026-106072 itself, which is listed as medium. The recommended action is to upgrade to the fixed Node.js releases named in the advisory, Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The flaw is improper certificate validation in tls.checkServerIdentity(): non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1 are not treated as IP addresses, so a certificate with only a numeric DNS SAN can authenticate an IP endpoint. Exploitation requires a certificate with a numeric DNS SAN issued by a CA the client trusts, and a platform resolver that accepts these spellings, such as glibc. The advisory says affected versions are Node.js 26.x, 24.x and 22.x, and gives fixed versions as Node.js v22.23.4, v24.22.1 and v26.12.1. No workaround is stated in the advisory, and no detection guidance is stated for this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.6	CVE-2026-106071	A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite, The Node.js Project Node.js	NVD	Oct 23 17:17 UTC
CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... Executive summary This advisory covers a low-severity flaw in the Node.js Permission Model, which is meant to restrict file access for Node.js programs. The flaw affects Node.js 26.x and can let code read files outside a wildcard read rule, such as reading /etc/passwd when only /etc/passwd.* is granted. The advisory rates it LOW and points users to the Node.js 26.x security release, Node.js v26.12.1, which is listed alongside the other fixes. Technical summary The flaw is in Node.js Permission Model filesystem enforcement, where the radix tree lookup for wildcard --allow-fs-read or --allow-fs-write rules stops comparing early when the requested path is shorter than the grant prefix, so the path is treated as a match. The advisory says it requires a wildcard grant sitting directly under the root of the permission tree, for example when it is the only grant for that scope, and that the attacker needs code running under --permission. It affects Node.js 26.x only. The advisory does not state a fixed version specifically for this CVE, though it lists Node.js v26.12.1 as the release for the 26.x line. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite The Node.js Project OpenSSL undici Node.js node c-ares SQLite The Node.js Project Node.js NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.7	CVE-2026-106070	A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite, Brotli	NVD	Oct 23 17:17 UTC
CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... Executive summary This advisory covers a batch of security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a high-severity Brotli decoder memory corruption issue that the advisory says could lead to remote code execution. The Node.js Project recommends updating to the fixed releases it names (v22.23.4, v24.22.1, v26.12.1) on or shortly after October 21, 2026, since end-of-life versions are always affected. Technical summary The advisory describes several vulnerability classes: an out-of-bounds write in the Brotli decoder (CVE-2026-111497, high) triggered by malformed compressed input passed to node:zlib, DNS name truncation at NUL bytes, TLS hostname verification bypasses for non-canonical IPv4 forms, HTTP keep-alive response confusion, entropy cache reuse in snapshots, ZipFile returning wrong bytes after header validation failure (26.x only), and Permission Model bypasses via wildcard matching and fs.realpathSync. Fixed versions are given as v22.23.4, v24.22.1, and v26.12.1. Workarounds are not stated in the advisory, and no CVSS scores or evidence of in-the-wild exploitation are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite Brotli OpenSSL undici Node.js node Node.js c-ares SQLite Brotli NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-106069	A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... Executive summary This advisory covers a Node.js security release addressing many flaws across the 26.x, 24.x, and 22.x release lines, with the CVE-2026-106069 issue being a TLS hostname verification flaw that can validate a server certificate against a different IP address than the one connected to. The advisory states the highest severity fixed in each release line is HIGH, and the vendor recommends upgrading to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1 on or shortly after October 21, 2026. Fixed versions for the specific CVE are as stated in the release notes; end-of-life versions are noted as always affected. Technical summary CVE-2026-106069 is a TLS hostname verification flaw in tls.checkServerIdentity() where a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1, is normalized as octal by WHATWG URL rules while the OS resolver reads it as decimal, so a certificate for another IP may be accepted; the advisory notes this occurs on some platforms such as macOS. It affects Node.js 26.x, 24.x, and 22.x, and the advisory states the fix is in the listed releases v22.23.4, v24.22.1, and v26.12.1. The advisory does not state any workaround for this CVE, and it does not state whether exploitation has occurred in the wild. The advisory does not give a CVSS score for this CVE and does not provide specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105483	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... Executive summary This advisory covers a set of security fixes in Node.js releases for the 26.x, 24.x, and 22.x lines, which the advisory says are scheduled for October 21, 2026. The advisory rates the highest severity issue as HIGH and recommends upgrading to the fixed releases, Node.js v22.23.4, v24.22.1, or v26.12.1, since end-of-life versions are always affected by security releases. Technical summary The fixes cover several classes of flaws: TLS hostname verification bypasses for non-canonical or non-ASCII IPv4 spellings (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), DNS name truncation at NUL bytes (CVE-2026-105482), HTTP keep-alive response confusion (CVE-2026-105481), and Permission Model bypasses via fs.realpathSync and wildcard grants (CVE-2026-106073, CVE-2026-106071). Entropy cache leakage into snapshots and SEAs (CVE-2026-106074) and ZIP prefix byte disclosure (CVE-2026-106070) are also addressed. The advisory does not state workarounds for these issues. Detection guidance is not stated. Dependency updates to c-ares, OpenSSL, SQLite, Undici, and a CA certificate list are also included, with the affected release lines given for each. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105482	A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() Executive summary This Node.js security release covers multiple flaws in the 26.x, 24.x and 22.x release lines, including several rated high severity, such as DNS name truncation, TLS hostname bypasses, and a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution. The advisory recommends updating to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1, which are stated as available on or shortly after October 21, 2026. Commercial support for versions past Maintenance LTS is noted as available through OpenJS partners. Technical summary The advisory describes several vulnerability classes: DNS name truncation at NUL bytes (CVE-2026-105482), TLS hostname verification bypasses for fullwidth-digit and leading-zero or non-canonical IPv4 hosts (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), an out-of-bounds write in the Brotli decoder that the advisory says can lead to a crash, memory disclosure, or remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), HTTP keep-alive response confusion, entropy cache leakage into snapshots and SEAs, ZIP header validation bypass, Permission Model wildcard over-grant, and a Permission Model bypass via fs.realpathSync. Affected versions are given per issue, and the fixed versions are listed as Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory does not state workarounds for any issue, and it does not give CVSS scores or exploitation-in-the-wild status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite eMudhra OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105481	A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request Executive summary This advisory covers a set of security fixes in Node.js release lines 26.x, 24.x, and 22.x, with several issues the advisory rates as high severity. The highest severity issue fixed in each release line is HIGH, and the advisory says End-of-Life versions are always affected when a security release occurs. The vendor recommends upgrading to the patched releases Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The issues include DNS name truncation at a NUL byte in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, a Brotli decoder out-of-bounds write that the advisory says can lead to a crash, memory disclosure, or remote code execution, a keep-alive HTTP socket issue that accepts a response sent before the request, crypto entropy cache reuse in startup snapshots and SEAs, a zlib.ZipFile header validation bypass, and Permission Model filesystem bypasses via wildcard rules and fs.realpathSync. Affected versions are listed per issue, and the fixed versions are Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory also lists dependency updates to c-ares, ca-cert, OpenSSL, SQLite, and Undici. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects