How many CVEs does Node.js node.js have?

Node.js node.js has 189 published CVE records since 2013.

How many Node.js node.js CVEs are in CISA KEV?

Yes — 1 of Node.js node.js's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Node.js node.js vulnerabilities?

Yes — 15 of Node.js node.js's CVEs have a known public exploit.

Which versions of Node.js node.js are affected?

576 distinct Node.js node.js versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Node.js node.js CVEs?

Node.js node.js's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-284 (Improper Access Control), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-295 (Improper Certificate Validation).

How many critical Node.js node.js vulnerabilities are there?

Node.js node.js has 22 critical and 104 high-severity CVEs.

What is the average severity of Node.js node.js CVEs?

The average CVSS base score across Node.js node.js's scored CVEs is 7.2.

node.js Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: node.js vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

node.js Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

node.js has 189 published CVE records since 2013, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting node.js, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include linux, windows.

Severity and exploitation

How the CVSS severity of node.js's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical22

High104

Medium57

Low6

In CISA’s Known Exploited Vulnerabilities catalog

One of node.js's CVEs is confirmed exploited in the wild.

Public exploits

15 of node.js's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every node.js version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

4.0.0 <= v <= 4.1.221 CVEs
6.0.0 <= v <= 6.8.117 CVEs
14.0.0 <= v <= 14.14.016 CVEs
8.0.0 <= v <= 8.8.116 CVEs
10.0.0 <= v <= 10.12.013 CVEs
16.0.0 <= v <= 16.12.012 CVEs
26.3.0 <= v <= 26.3.010 CVEs
22.22.3 <= v <= 22.22.39 CVEs
24.16.0 <= v <= 24.16.09 CVEs
12.0.0 <= v < 12.8.18 CVEs
25.0.0 <= v <= 25.8.18 CVEs

Common weakness types

The CWE weakness categories most often found in node.js CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many node.js CVEs were published each year.

2015

2016

2017

2018

2019

2020

2021

Other Node.js products

Browse vulnerabilities for other products by Node.js.

Node203 CVEs undici35 CVEs nodejs19 CVEs llhttp7 CVEs elliptic1 CVEs import-in-the-middle1 CVEs

All Node.js vulnerabilities

Frequently asked questions

Common questions about node.js vulnerabilities.

How many CVEs does Node.js node.js have?: Node.js node.js has 189 published CVE records since 2013.
How many Node.js node.js CVEs are in CISA KEV?: Yes — 1 of Node.js node.js's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Node.js node.js vulnerabilities?: Yes — 15 of Node.js node.js's CVEs have a known public exploit.
Which versions of Node.js node.js are affected?: 576 distinct Node.js node.js versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Node.js node.js CVEs?: Node.js node.js's CVEs most often map to these CWE weakness types: CWE-400 (Uncontrolled Resource Consumption), CWE-284 (Improper Access Control), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-295 (Improper Certificate Validation).
How many critical Node.js node.js vulnerabilities are there?: Node.js node.js has 22 critical and 104 high-severity CVEs.
What is the average severity of Node.js node.js CVEs?: The average CVSS base score across Node.js node.js's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track node.js vulnerabilities

Monitor new node.js vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing