# NodeBB vulnerabilities Source: https://junglewise.ai/threats/technologies/nodebb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/nodebb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in NodeBB: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120007, was published on 30 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 16 (0 critical, 0 exploited in the wild) ## About NodeBB Node.js-based forum software for building online communities and discussion platforms. ## Latest NodeBB vulnerabilities - [CVE-2026-120007: NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-58593: NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto) (high, CVSS 7.5, published 1 Jul 2026) - [CVE-2025-50979: NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint) (medium, CVSS 4, published 27 Aug 2025) - [CVE-2024-57041: NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile) (low, CVSS 3.1, published 24 Jan 2025) - [CVE-2024-29316: NodeBB incorrect access control in admin tabs](https://junglewise.ai/threats/cve-2024-29316-nodebb-incorrect-access-control-in-admin-tabs) (low, CVSS 3.1, published 29 Mar 2024) - [CVE-2023-2850: NodeBB cross-origin WebSocket session hijacking](https://junglewise.ai/threats/cve-2023-2850-nodebb-cross-origin-websocket-session-hijacking) (low, CVSS 3.1, published 25 Jul 2023) - [CVE-2023-26045: NodeBB path traversal and code execution in user export](https://junglewise.ai/threats/cve-2023-26045-nodebb-path-traversal-and-code-execution-in-user-export) (low, CVSS 3.1, published 25 Jul 2023) - [CVE-2022-46164: NodeBB account takeover via prototype vulnerability](https://junglewise.ai/threats/cve-2022-46164-nodebb-account-takeover-via-prototype-vulnerability) (low, CVSS 3.1, published 5 Dec 2022) - [CVE-2022-3978: NodeBB Cross-Site Request Forgery in registration abort](https://junglewise.ai/threats/cve-2022-3978-nodebb-cross-site-request-forgery-in-registration-abort) (low, CVSS 3.1, published 13 Nov 2022) - [CVE-2022-36076: NodeBB account takeover via SSO plugins](https://junglewise.ai/threats/cve-2022-36076-nodebb-account-takeover-via-sso-plugins) (low, CVSS 3.1, published 16 Sep 2022) - [CVE-2022-36045: NodeBB cryptographically weak PRNG in password reset](https://junglewise.ai/threats/cve-2022-36045-nodebb-cryptographically-weak-prng-in-password-reset) (low, CVSS 3.1, published 30 Aug 2022) - [CVE-2015-3296: NodeBB cross-site scripting in Markdown processing](https://junglewise.ai/threats/cve-2015-3296-nodebb-cross-site-scripting-in-markdown-processing) (low, CVSS 3, published 17 May 2022) - [CVE-2021-43786: NodeBB API token verification bypass](https://junglewise.ai/threats/cve-2021-43786-nodebb-api-token-verification-bypass) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2021-43787: NodeBB XSS via prototype pollution in uploader](https://junglewise.ai/threats/cve-2021-43787-nodebb-xss-via-prototype-pollution-in-uploader) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2021-43788: NodeBB path traversal in translator module](https://junglewise.ai/threats/cve-2021-43788-nodebb-path-traversal-in-translator-module) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2015-9286: NodeBB cross-site scripting in outgoing controller](https://junglewise.ai/threats/cve-2015-9286-nodebb-cross-site-scripting-in-outgoing-controller) (low, CVSS 3, published 1 May 2019) ## Most severe NodeBB vulnerabilities - [CVE-2026-58593: NodeBB author spoofing via unvalidated ActivityPub attributedTo field](https://junglewise.ai/threats/cve-2026-58593-nodebb-author-spoofing-via-unvalidated-activitypub-attributedto) (high, CVSS 7.5, published 1 Jul 2026) - [CVE-2026-120007: NodeBB authorization bypass in user registration](https://junglewise.ai/threats/cve-2026-120007-nodebb-1-18-0-through-4-16-5-contains-an-authorization-bypass) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2025-50979: NodeBB SQL injection in search-categories endpoint](https://junglewise.ai/threats/cve-2025-50979-nodebb-sql-injection-in-search-categories-endpoint) (medium, CVSS 4, published 27 Aug 2025) - [CVE-2022-46164: NodeBB account takeover via prototype vulnerability](https://junglewise.ai/threats/cve-2022-46164-nodebb-account-takeover-via-prototype-vulnerability) (low, CVSS 3.1, published 5 Dec 2022) - [CVE-2024-57041: NodeBB persistent cross-site scripting in profile](https://junglewise.ai/threats/cve-2024-57041-nodebb-persistent-cross-site-scripting-in-profile) (low, CVSS 3.1, published 24 Jan 2025) - [CVE-2021-43788: NodeBB path traversal in translator module](https://junglewise.ai/threats/cve-2021-43788-nodebb-path-traversal-in-translator-module) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2021-43786: NodeBB API token verification bypass](https://junglewise.ai/threats/cve-2021-43786-nodebb-api-token-verification-bypass) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2022-36045: NodeBB cryptographically weak PRNG in password reset](https://junglewise.ai/threats/cve-2022-36045-nodebb-cryptographically-weak-prng-in-password-reset) (low, CVSS 3.1, published 30 Aug 2022) - [CVE-2021-43787: NodeBB XSS via prototype pollution in uploader](https://junglewise.ai/threats/cve-2021-43787-nodebb-xss-via-prototype-pollution-in-uploader) (low, CVSS 3.1, published 30 Nov 2021) - [CVE-2023-26045: NodeBB path traversal and code execution in user export](https://junglewise.ai/threats/cve-2023-26045-nodebb-path-traversal-and-code-execution-in-user-export) (low, CVSS 3.1, published 25 Jul 2023) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "NodeBB vulnerabilities", https://junglewise.ai/threats/technologies/nodebb, 9 November 2026.