{"schema_version":1,"title":"OpenJS Foundation Node.js vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in OpenJS Foundation Node.js: 12 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126051, was published on 11 November 2026. 6 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/openjs-foundation-node-js","json_url":"https://junglewise.ai/threats/technologies/openjs-foundation-node-js.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/openjs-foundation-node-js","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":10,"all_time":18,"critical":0,"exploited":0,"last_7_days":12,"last_30_days":18,"last_90_days":18,"last_365_days":18},"latest":[{"cve":"CVE-2026-126051","cvss":7.5,"slug":"cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server","title":"Node.js TLS server use-after-destroy in deferred handshake callbacks","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:36.6+00:00","url":"https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server"},{"cve":"CVE-2026-123877","cvss":6.8,"slug":"cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a","title":"Node.js https.Agent certificate validation bypass via TLS session reuse","severity":"medium","exploited":false,"published_at":"2026-11-11T19:17:34.9+00:00","url":"https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a"},{"cve":"CVE-2026-123875","cvss":5.9,"slug":"cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an","title":"Node.js HTTP/2 denial of service via NULL pointer dereference","severity":"medium","exploited":false,"published_at":"2026-11-11T19:17:34.697+00:00","url":"https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an"},{"cve":"CVE-2026-123874","cvss":7.5,"slug":"cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated","title":"Node.js HTTP/2 use-after-free in respondWithFile stream reset","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:34.49+00:00","url":"https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated"},{"cve":"CVE-2026-123872","cvss":8.1,"slug":"cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a","title":"Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:34.27+00:00","url":"https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a"},{"cve":"CVE-2026-123871","cvss":6.2,"slug":"cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config","title":"Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIG","severity":"medium","exploited":false,"published_at":"2026-11-11T19:17:34.07+00:00","url":"https://junglewise.ai/threats/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config"},{"cve":"CVE-2026-123868","cvss":5.9,"slug":"cve-2026-123868-an-unauthenticated-http-2-client-can-exhaust-node-js-server","title":"Node.js HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA","severity":"medium","exploited":false,"published_at":"2026-11-11T19:17:33.69+00:00","url":"https://junglewise.ai/threats/cve-2026-123868-an-unauthenticated-http-2-client-can-exhaust-node-js-server"},{"cve":"CVE-2026-123867","cvss":4.2,"slug":"cve-2026-123867-a-per-host-mutual-tls-authorization-bypass-in-node-js-lets-a","title":"Node.js mutual-TLS authorization bypass via CA-only SNI context","severity":"medium","exploited":false,"published_at":"2026-11-11T19:17:33.48+00:00","url":"https://junglewise.ai/threats/cve-2026-123867-a-per-host-mutual-tls-authorization-bypass-in-node-js-lets-a"},{"cve":"CVE-2026-123866","cvss":7.5,"slug":"cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak","title":"Node.js HTTP/2 use-after-free in stream teardown","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:33.243+00:00","url":"https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak"},{"cve":"CVE-2026-123865","cvss":7.5,"slug":"cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js","title":"Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdown","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:33+00:00","url":"https://junglewise.ai/threats/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js"},{"cve":"CVE-2026-123864","cvss":8.1,"slug":"cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated","title":"Node.js HTTPS memory disclosure via TLS write re-entrancy","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:32.79+00:00","url":"https://junglewise.ai/threats/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated"},{"cve":"CVE-2026-123863","cvss":8.2,"slug":"cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets","title":"Node.js HTTP/2 assertion failure in session teardown denial of service","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:32.577+00:00","url":"https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets"},{"cve":"CVE-2026-106074","cvss":4.8,"slug":"cve-2026-106074-a-flaw-in-node-js-crypto-causes-the-internal-entropy-caches-used","title":"Node.js crypto entropy cache reuse in snapshots","severity":"medium","exploited":false,"published_at":"2026-10-23T17:17:20.473+00:00","url":"https://junglewise.ai/threats/cve-2026-106074-a-flaw-in-node-js-crypto-causes-the-internal-entropy-caches-used"},{"cve":"CVE-2026-106072","cvss":6.7,"slug":"cve-2026-106072-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate","title":"Node.js TLS certificate hostname verification bypass with non-canonical IPv4","severity":"medium","exploited":false,"published_at":"2026-10-23T17:17:20.203+00:00","url":"https://junglewise.ai/threats/cve-2026-106072-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate"},{"cve":"CVE-2026-106069","cvss":7.4,"slug":"cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server","title":"Node.js TLS hostname verification bypass with non-canonical IPv4","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.74+00:00","url":"https://junglewise.ai/threats/cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server"},{"cve":"CVE-2026-105483","cvss":7.4,"slug":"cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate","title":"Node.js TLS certificate hostname verification bypass with fullwidth digits","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.573+00:00","url":"https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate"},{"cve":"CVE-2026-105482","cvss":7.4,"slug":"cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a","title":"Node.js dns.resolve() NUL byte hostname truncation","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.427+00:00","url":"https://junglewise.ai/threats/cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a"},{"cve":"CVE-2026-105481","cvss":6.5,"slug":"cve-2026-105481-a-flaw-in-node-js-http-agent-connection-reuse-can-cause-a-client","title":"Node.js HTTP Agent response confusion via keep-alive socket reuse","severity":"medium","exploited":false,"published_at":"2026-10-23T17:17:19.25+00:00","url":"https://junglewise.ai/threats/cve-2026-105481-a-flaw-in-node-js-http-agent-connection-reuse-can-cause-a-client"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":12}],"related":[{"name":"OpenJS Foundation Multer","slug":"multer","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/multer"},{"name":"OpenJS Foundation Undici","slug":"openjs-foundation-undici","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/openjs-foundation-undici"},{"name":"OpenJS Foundation Electron","slug":"openjs-foundation-electron","vulnerabilities":11,"url":"https://junglewise.ai/threats/technologies/openjs-foundation-electron"},{"name":"OpenJS Foundation Morgan","slug":"morgan","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/morgan"},{"name":"OpenJS Foundation Body-Parser","slug":"body-parser","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/body-parser"}],"technology":{"hub":true,"name":"OpenJS Foundation Node.js","slug":"openjs-foundation-node-js","vendor":{"hub":true,"name":"OpenJS Foundation","slug":"openjs-foundation","url":"https://junglewise.ai/threats/vendors/openjs-foundation"},"aliases":[],"category":"runtime","description":"JavaScript runtime environment built on Chrome's V8 engine for server-side and command-line application development.","url":"https://junglewise.ai/threats/technologies/openjs-foundation-node-js"},"most_severe":[{"cve":"CVE-2026-123863","cvss":8.2,"slug":"cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets","title":"Node.js HTTP/2 assertion failure in session teardown denial of service","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:32.577+00:00","url":"https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets"},{"cve":"CVE-2026-123872","cvss":8.1,"slug":"cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a","title":"Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:34.27+00:00","url":"https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a"},{"cve":"CVE-2026-123864","cvss":8.1,"slug":"cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated","title":"Node.js HTTPS memory disclosure via TLS write re-entrancy","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:32.79+00:00","url":"https://junglewise.ai/threats/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated"},{"cve":"CVE-2026-126051","cvss":7.5,"slug":"cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server","title":"Node.js TLS server use-after-destroy in deferred handshake callbacks","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:36.6+00:00","url":"https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server"},{"cve":"CVE-2026-123874","cvss":7.5,"slug":"cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated","title":"Node.js HTTP/2 use-after-free in respondWithFile stream reset","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:34.49+00:00","url":"https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated"},{"cve":"CVE-2026-123866","cvss":7.5,"slug":"cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak","title":"Node.js HTTP/2 use-after-free in stream teardown","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:33.243+00:00","url":"https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak"},{"cve":"CVE-2026-123865","cvss":7.5,"slug":"cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js","title":"Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdown","severity":"high","exploited":false,"published_at":"2026-11-11T19:17:33+00:00","url":"https://junglewise.ai/threats/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js"},{"cve":"CVE-2026-106069","cvss":7.4,"slug":"cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server","title":"Node.js TLS hostname verification bypass with non-canonical IPv4","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.74+00:00","url":"https://junglewise.ai/threats/cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server"},{"cve":"CVE-2026-105483","cvss":7.4,"slug":"cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate","title":"Node.js TLS certificate hostname verification bypass with fullwidth digits","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.573+00:00","url":"https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate"},{"cve":"CVE-2026-105482","cvss":7.4,"slug":"cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a","title":"Node.js dns.resolve() NUL byte hostname truncation","severity":"high","exploited":false,"published_at":"2026-10-23T17:17:19.427+00:00","url":"https://junglewise.ai/threats/cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a"}],"generated_at":"2026-11-11T20:07:00.152569+00:00"}