Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,300
Erlang
31
GitHub Actions
21
Go
2,065
Maven
5,000+
npm
3,744
NuGet
668
pip
3,427
Pub
12
RubyGems
892
Rust
877
Swift
36
Unreviewed advisories
All unreviewed
5,000+
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.

60 advisories

Loading
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with... High Unreviewed
CVE-2018-12121 was published May 13, 2022
Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial... High Unreviewed
CVE-2018-12122 was published May 13, 2022
A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP... High Unreviewed
CVE-2024-22019 was published Feb 20, 2024
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental... High Unreviewed
CVE-2023-30587 was published Sep 7, 2024
fs.openAsBlob() can bypass the experimental permission model when using the file system read... High Unreviewed
CVE-2023-30583 was published Sep 7, 2024
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked... High Unreviewed
CVE-2023-46809 was published Sep 7, 2024
A vulnerability has been discovered in Node.js version 20, specifically within the experimental... High Unreviewed
CVE-2023-30584 was published Sep 7, 2024
The permission model protects itself against path traversal attacks by calling path.resolve() on... High Unreviewed
CVE-2024-21896 was published Feb 20, 2024
setuid() does not affect libuv's internal io_uring operations if initialized before the call to... High Unreviewed
CVE-2024-22017 was published Mar 19, 2024
WD Discovery versions prior to 5.0.589 contain a misconfiguration in the Node.js environment... High Unreviewed
CVE-2024-22169 was published Aug 2, 2024
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit... High Unreviewed
CVE-2023-39331 was published Oct 18, 2023
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount... High Unreviewed
CVE-2024-27983 was published Apr 9, 2024
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs... High Unreviewed
CVE-2024-21891 was published Feb 20, 2024
On Linux, Node.js ignores certain environment variables if those may have been set by an... High Unreviewed
CVE-2024-21892 was published Feb 20, 2024
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require... High Unreviewed
CVE-2023-32006 was published Aug 15, 2023
A privilege escalation vulnerability exists in the experimental policy mechanism in all active... High Unreviewed
CVE-2023-32559 was published Aug 24, 2023
A vulnerability has been discovered in Node.js version 20, specifically within the experimental... High Unreviewed
CVE-2023-32004 was published Aug 15, 2023
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer... High Unreviewed
CVE-2019-15605 was published May 24, 2022
In Node.js including 6.x before 6.17.0, 8.x before 8.15.1, 10.x before 10.15.2, and 11.x before... High Unreviewed
CVE-2019-5737 was published May 13, 2022
When the Node.js policy feature checks the integrity of a resource against a trusted manifest,... High Unreviewed
CVE-2023-38552 was published Oct 18, 2023
Out-of-Bounds Read in Node.js High Unreviewed
CVE-2021-22918 was published Jul 13, 2021
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an... High Unreviewed
CVE-2021-22940 was published May 24, 2022
The use of the deprecated API `process.binding()` can bypass the permission model through path... High Unreviewed
CVE-2023-32558 was published Sep 15, 2023
A vulnerability has been identified in the Node.js (.msi version) installation process,... High Unreviewed
CVE-2023-30585 was published Nov 28, 2023
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism... High Unreviewed
CVE-2023-30581 was published Nov 23, 2023
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database