Technology · OpenJS Foundation
OpenJS Foundation Node.js vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 18 vulnerabilities in OpenJS Foundation Node.js: 12 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126051, was published on 11 November 2026. 6 vulnerabilities in the last four weeks, up from none in the four before.
- Last 7 days
- 12
- Last 90 days
- 18
- Critical, all time
- 0
- Exploited in the wild
- 0
About OpenJS Foundation Node.js
JavaScript runtime environment built on Chrome's V8 engine for server-side and command-line application development.
Latest OpenJS Foundation Node.js vulnerabilities
- CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbackshighCVSS 7.5
- CVE-2026-123877: Node.js https.Agent certificate validation bypass via TLS session reusemediumCVSS 6.8
- CVE-2026-123875: Node.js HTTP/2 denial of service via NULL pointer dereferencemediumCVSS 5.9
- CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream resethighCVSS 7.5
- CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername changehighCVSS 8.1
- CVE-2026-123871: Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIGmediumCVSS 6.2
- CVE-2026-123868: Node.js HTTP/2 memory exhaustion denial of service via unaccounted inbound DATAmediumCVSS 5.9
- CVE-2026-123867: Node.js mutual-TLS authorization bypass via CA-only SNI contextmediumCVSS 4.2
- CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardownhighCVSS 7.5
- CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdownhighCVSS 7.5
- CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancyhighCVSS 8.1
- CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of servicehighCVSS 8.2
- CVE-2026-106074: Node.js crypto entropy cache reuse in snapshotsmediumCVSS 4.8
- CVE-2026-106072: Node.js TLS certificate hostname verification bypass with non-canonical IPv4mediumCVSS 6.7
- CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4highCVSS 7.4
- CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digitshighCVSS 7.4
- CVE-2026-105482: Node.js dns.resolve() NUL byte hostname truncationhighCVSS 7.4
- CVE-2026-105481: Node.js HTTP Agent response confusion via keep-alive socket reusemediumCVSS 6.5
Most severe OpenJS Foundation Node.js vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of servicehighCVSS 8.2
- CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername changehighCVSS 8.1
- CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancyhighCVSS 8.1
- CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbackshighCVSS 7.5
- CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream resethighCVSS 7.5
- CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardownhighCVSS 7.5
- CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdownhighCVSS 7.5
- CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4highCVSS 7.4
- CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digitshighCVSS 7.4
- CVE-2026-105482: Node.js dns.resolve() NUL byte hostname truncationhighCVSS 7.4
Vulnerabilities per week
6 vulnerabilities in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 6 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 12 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many OpenJS Foundation Node.js vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/openjs-foundation-node-js)<a href="https://junglewise.ai/threats/technologies/openjs-foundation-node-js"><img src="https://junglewise.ai/threats/technologies/openjs-foundation-node-js/badge.svg" alt="OpenJS Foundation Node.js vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/openjs-foundation-node-js.json, and this page as text at https://junglewise.ai/threats/technologies/openjs-foundation-node-js.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "OpenJS Foundation Node.js vulnerabilities", https://junglewise.ai/threats/technologies/openjs-foundation-node-js, 11 November 2026.