Vendor
OpenJS Foundation vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 56 vulnerabilities in OpenJS Foundation: 16 in the last 7 days and 42 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-126051, was published on 11 November 2026. 24 vulnerabilities in the last four weeks, up 380% on the four before (5). 2 critical against 1. 6 technologies have a page of their own.
- Last 7 days
- 16
- Last 90 days
- 42
- Critical, all time
- 4
- Exploited in the wild
- 1
About OpenJS Foundation
Non-profit organization that supports the development and growth of JavaScript and related technologies in the open-source ecosystem.
OpenJS Foundation technologies
Latest OpenJS Foundation vulnerabilities
- CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbackshighCVSS 7.5
- CVE-2026-123877: Node.js https.Agent certificate validation bypass via TLS session reusemediumCVSS 6.8
- CVE-2026-123875: Node.js HTTP/2 denial of service via NULL pointer dereferencemediumCVSS 5.9
- CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream resethighCVSS 7.5
- CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername changehighCVSS 8.1
- CVE-2026-123871: Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIGmediumCVSS 6.2
- CVE-2026-123868: Node.js HTTP/2 memory exhaustion denial of service via unaccounted inbound DATAmediumCVSS 5.9
- CVE-2026-123867: Node.js mutual-TLS authorization bypass via CA-only SNI contextmediumCVSS 4.2
- CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardownhighCVSS 7.5
- CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdownhighCVSS 7.5
- CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancyhighCVSS 8.1
- CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of servicehighCVSS 8.2
- CVE-2026-120474: undici cross-user cache disclosure via same-origin redirectmediumCVSS 6.5
- CVE-2026-120423: undici Subresource Integrity bypass via whitespace in integrity metadatamediumCVSS 5.9
- CVE-2026-120222: undici denial of service via unhandled exception in cache-interceptormediumCVSS 5.9
- CVE-2026-116592: undici cache poisoning and cross-user disclosure via intermediate redirecthighCVSS 7.4
- CVE-2026-120216: Fastify denial of service via uncaught exception on handlerTimeout with streaming responsesmediumCVSS 5.9
- CVE-2026-120213: @fastify/http-proxy prefix escape via decoded route parameterscriticalCVSS 9.1
- CVE-2026-117549: @fastify/secure-session signature verification bypass via cookie signature removalmediumCVSS 4.2
- CVE-2026-117518: @fastify/reply-from path traversal via backslash dot-segment escapehighCVSS 8.2
- CVE-2026-112362: @fastify/express path-scoped middleware bypass via absolute-form requestscriticalCVSS 9.1
- CVE-2026-106074: Node.js crypto entropy cache reuse in snapshotsmediumCVSS 4.8
- CVE-2026-106072: Node.js TLS certificate hostname verification bypass with non-canonical IPv4mediumCVSS 6.7
- CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4highCVSS 7.4
- CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digitshighCVSS 7.4
Most severe OpenJS Foundation vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-5217: Electron heap buffer overflow in libvpx vp8 encodingcriticalexploited in the wildCVSS 3.1EPSS 49.0%
- CVE-2026-92395: @fastify/proxy-addr IP spoofing via IPv4-mapped IPv6 trust subnetcriticalCVSS 9.1EPSS 0.3%
- CVE-2026-120213: @fastify/http-proxy prefix escape via decoded route parameterscriticalCVSS 9.1
- CVE-2026-112362: @fastify/express path-scoped middleware bypass via absolute-form requestscriticalCVSS 9.1
- CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of servicehighCVSS 8.2
- CVE-2026-117518: @fastify/reply-from path traversal via backslash dot-segment escapehighCVSS 8.2
- CVE-2026-102674: Electron sandbox escape via popup windows in top-level documenthighCVSS 8.2
- CVE-2026-92087: @fastify/auth authorization bypass via order-dependent evaluationhighCVSS 8.1EPSS 0.5%
- CVE-2026-18500: @fastify/jwt authorization bypass via global secret overridehighCVSS 8.1EPSS 0.3%
- CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername changehighCVSS 8.1
Vulnerabilities per week
24 vulnerabilities in the last four weeks, up 380% on the four before (5). 2 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 2 | 1 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 2 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 8 | 0 | |
| 19 Oct 2026 | 7 | 0 | |
| 26 Oct 2026 | 1 | 1 | |
| 2 Nov 2026 | 8 | 1 | |
| 9 Nov 2026 | 12 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many OpenJS Foundation vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/openjs-foundation)<a href="https://junglewise.ai/threats/vendors/openjs-foundation"><img src="https://junglewise.ai/threats/vendors/openjs-foundation/badge.svg" alt="OpenJS Foundation vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/openjs-foundation.json, and this page as text at https://junglewise.ai/threats/vendors/openjs-foundation.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "OpenJS Foundation vulnerabilities", https://junglewise.ai/threats/vendors/openjs-foundation, 12 November 2026.