Search CVE reports


Toggle filters

11 – 20 of 214 results


CVE-2025-15467

Medium priority

Some fixes available 3 of 10

Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or...

4 affected packages

openssl, openssl1.0, nodejs, edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
openssl Fixed Fixed Not affected Not affected
openssl1.0 Not in release Not in release Not affected
nodejs Not affected Vulnerable Not affected Needs evaluation
edk2 Needs evaluation Not affected Not affected Not affected
Show less packages

CVE-2025-11187

Medium priority

Some fixes available 1 of 7

Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer...

4 affected packages

openssl, openssl1.0, nodejs, edk2

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
openssl Not affected Not affected Not affected Not affected
openssl1.0 Not in release Not in release Not affected
nodejs Not affected Vulnerable Not affected Needs evaluation
edk2 Not affected Not affected Not affected Not affected
Show less packages

CVE-2026-21637

Medium priority
Needs evaluation

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2026-21636

Medium priority
Needs evaluation

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-59466

Medium priority
Needs evaluation

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-59465

Medium priority
Needs evaluation

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-59464

Medium priority
Needs evaluation

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-55132

Medium priority
Needs evaluation

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-55131

Medium priority
Needs evaluation

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages

CVE-2025-55130

Medium priority
Needs evaluation

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the...

1 affected package

nodejs

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS
nodejs Needs evaluation Needs evaluation Needs evaluation Needs evaluation
Show less packages