Search for packages
| purl | pkg:deb/debian/nodejs@18.20.4%2Bdfsg-1~deb12u1 |
| Next non-vulnerable version | 20.19.2+dfsg-1 |
| Latest non-vulnerable version | 20.19.2+dfsg-1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1vp3-fzdr-yqbm
Aliases: CVE-2026-21715 |
Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions |
Affected by 0 other vulnerabilities. |
|
VCID-2t7c-dju9-pff6
Aliases: CVE-2026-21713 |
Node.js: Node.js: Information disclosure via timing oracle in HMAC verification |
Affected by 0 other vulnerabilities. |
|
VCID-43sf-4r41-wugc
Aliases: CVE-2025-55132 |
nodejs: Nodejs filesystem permissions bypass |
Affected by 0 other vulnerabilities. |
|
VCID-96yh-1wub-zucg
Aliases: CVE-2026-21714 |
Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames |
Affected by 0 other vulnerabilities. |
|
VCID-98fy-tedc-ube7
Aliases: CVE-2025-55131 |
nodejs: Nodejs uninitialized memory exposure |
Affected by 0 other vulnerabilities. |
|
VCID-bjza-25hu-vkad
Aliases: CVE-2026-21637 |
nodejs: Nodejs denial of service |
Affected by 0 other vulnerabilities. |
|
VCID-dgkh-jdah-wfh9
Aliases: CVE-2026-21717 |
nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions |
Affected by 0 other vulnerabilities. |
|
VCID-dt7u-3usg-9uet
Aliases: CVE-2026-21710 |
Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header |
Affected by 0 other vulnerabilities. |
|
VCID-twc8-ewm7-wkb1
Aliases: CVE-2026-21716 |
nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. |
Affected by 0 other vulnerabilities. |
|
VCID-u8bq-8jp4-jkem
Aliases: CVE-2025-59466 |
nodejs: Nodejs denial of service |
Affected by 0 other vulnerabilities. |
|
VCID-v7uy-445x-tuan
Aliases: CVE-2025-59465 |
nodejs: Nodejs denial of service |
Affected by 0 other vulnerabilities. |
|
VCID-wf5t-3pwz-c7d7
Aliases: CVE-2025-23085 |
Multiple vulnerabilities have been discovered in Node.js, the worst of which can lead to arbitrary code execution. |
Affected by 0 other vulnerabilities. |
|
VCID-x1an-pjq4-nbby
Aliases: CVE-2025-55130 |
nodejs: Nodejs file permissions bypass |
Affected by 0 other vulnerabilities. |
|
VCID-xkpz-pb5y-jqcy
Aliases: CVE-2025-23166 |
nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-2z1f-7jkw-17av | Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code. |
CVE-2024-27982
|
| VCID-38k9-23j3-eqh7 | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2023-30581
|
| VCID-9yq7-aba3-c7c3 | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2023-32559
|
| VCID-bx67-aud6-b3fa | Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code. |
CVE-2024-22025
|
| VCID-c8xz-v6h3-6ueb | nodejs: libuv: Out-of-Bounds Access Due to Inconsistent off_t Size in libuv and Node.js Build on i386 |
CVE-2025-47153
|
| VCID-e6gj-fe31-kkh5 | Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code. |
CVE-2023-46809
|
| VCID-e7u5-356v-jbg7 | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2023-30590
|
| VCID-kj75-vmwa-gqgq | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2023-32006
|
| VCID-nenk-4cgd-fugv | Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code. |
CVE-2024-27983
|
| VCID-sag8-repb-g3f4 | Multiple vulnerabilities have been discovered in Node.js. |
CVE-2023-32002
|
| VCID-vkvx-gxbu-3uau | Multiple vulnerabilities have been discovered in Node.js, the worst of which could lead to execution of arbitrary code. |
CVE-2024-22019
|
| VCID-wf5t-3pwz-c7d7 | Multiple vulnerabilities have been discovered in Node.js, the worst of which can lead to arbitrary code execution. |
CVE-2025-23085
|
| VCID-zstw-3wmu-u3c8 | llhttp vulnerable to HTTP request smuggling The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 |
CVE-2023-30589
GHSA-cggh-pq45-6h9x |