# OpenJS Foundation Node.js vulnerabilities Source: https://junglewise.ai/threats/technologies/openjs-foundation-node-js Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 20:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/openjs-foundation-node-js.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in OpenJS Foundation Node.js: 12 in the last 7 days and 18 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126051, was published on 11 November 2026. 6 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 12 - Last 30 days: 18 - Last 90 days: 18 - All time: 18 (0 critical, 0 exploited in the wild) ## About OpenJS Foundation Node.js JavaScript runtime environment built on Chrome's V8 engine for server-side and command-line application development. ## Latest OpenJS Foundation Node.js vulnerabilities - [CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123877: Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a) (medium, CVSS 6.8, published 11 Nov 2026) - [CVE-2026-123875: Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an) (medium, CVSS 5.9, published 11 Nov 2026) - [CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-123871: Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIG](https://junglewise.ai/threats/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config) (medium, CVSS 6.2, published 11 Nov 2026) - [CVE-2026-123868: Node.js HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA](https://junglewise.ai/threats/cve-2026-123868-an-unauthenticated-http-2-client-can-exhaust-node-js-server) (medium, CVSS 5.9, published 11 Nov 2026) - [CVE-2026-123867: Node.js mutual-TLS authorization bypass via CA-only SNI context](https://junglewise.ai/threats/cve-2026-123867-a-per-host-mutual-tls-authorization-bypass-in-node-js-lets-a) (medium, CVSS 4.2, published 11 Nov 2026) - [CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardown](https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdown](https://junglewise.ai/threats/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancy](https://junglewise.ai/threats/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of service](https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-106074: Node.js crypto entropy cache reuse in snapshots](https://junglewise.ai/threats/cve-2026-106074-a-flaw-in-node-js-crypto-causes-the-internal-entropy-caches-used) (medium, CVSS 4.8, published 23 Oct 2026) - [CVE-2026-106072: Node.js TLS certificate hostname verification bypass with non-canonical IPv4](https://junglewise.ai/threats/cve-2026-106072-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate) (medium, CVSS 6.7, published 23 Oct 2026) - [CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4](https://junglewise.ai/threats/cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digits](https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105482: Node.js dns.resolve() NUL byte hostname truncation](https://junglewise.ai/threats/cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105481: Node.js HTTP Agent response confusion via keep-alive socket reuse](https://junglewise.ai/threats/cve-2026-105481-a-flaw-in-node-js-http-agent-connection-reuse-can-cause-a-client) (medium, CVSS 6.5, published 23 Oct 2026) ## Most severe OpenJS Foundation Node.js vulnerabilities - [CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of service](https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancy](https://junglewise.ai/threats/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardown](https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdown](https://junglewise.ai/threats/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4](https://junglewise.ai/threats/cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digits](https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105482: Node.js dns.resolve() NUL byte hostname truncation](https://junglewise.ai/threats/cve-2026-105482-a-flaw-in-node-js-dns-resolution-allows-hostnames-containing-a) (high, CVSS 7.4, published 23 Oct 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 12 | 0 | 0 | ## Other OpenJS Foundation technologies - [OpenJS Foundation Multer](https://junglewise.ai/threats/technologies/multer): 14 vulnerabilities - [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici): 12 vulnerabilities - [OpenJS Foundation Electron](https://junglewise.ai/threats/technologies/openjs-foundation-electron): 11 vulnerabilities - [OpenJS Foundation Morgan](https://junglewise.ai/threats/technologies/morgan): 4 vulnerabilities - [OpenJS Foundation Body-Parser](https://junglewise.ai/threats/technologies/body-parser): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenJS Foundation Node.js vulnerabilities", https://junglewise.ai/threats/technologies/openjs-foundation-node-js, 11 November 2026.