# OpenJS Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/openjs-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/openjs-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 56 vulnerabilities in OpenJS Foundation: 16 in the last 7 days and 42 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-126051, was published on 11 November 2026. 24 vulnerabilities in the last four weeks, up 380% on the four before (5). 2 critical against 1. 6 technologies have a page of their own. ## Counts - Last 7 days: 16 - Last 30 days: 36 - Last 90 days: 42 - All time: 56 (4 critical, 1 exploited in the wild) ## About OpenJS Foundation Non-profit organization that supports the development and growth of JavaScript and related technologies in the open-source ecosystem. ## Latest OpenJS Foundation vulnerabilities - [CVE-2026-126051: Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123877: Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a) (medium, CVSS 6.8, published 11 Nov 2026) - [CVE-2026-123875: Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an) (medium, CVSS 5.9, published 11 Nov 2026) - [CVE-2026-123874: Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-123871: Node.js proxy credential disclosure in ERR_PROXY_INVALID_CONFIG](https://junglewise.ai/threats/cve-2026-123871-node-js-discloses-proxy-credentials-in-err-proxy-invalid-config) (medium, CVSS 6.2, published 11 Nov 2026) - [CVE-2026-123868: Node.js HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA](https://junglewise.ai/threats/cve-2026-123868-an-unauthenticated-http-2-client-can-exhaust-node-js-server) (medium, CVSS 5.9, published 11 Nov 2026) - [CVE-2026-123867: Node.js mutual-TLS authorization bypass via CA-only SNI context](https://junglewise.ai/threats/cve-2026-123867-a-per-host-mutual-tls-authorization-bypass-in-node-js-lets-a) (medium, CVSS 4.2, published 11 Nov 2026) - [CVE-2026-123866: Node.js HTTP/2 use-after-free in stream teardown](https://junglewise.ai/threats/cve-2026-123866-a-use-after-free-in-node-js-http-2-stream-teardown-can-leak) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123865: Node.js HTTP/2 memory and file-descriptor leak via protocol error during shutdown](https://junglewise.ai/threats/cve-2026-123865-an-unauthenticated-http-2-client-can-permanently-leak-node-js) (high, CVSS 7.5, published 11 Nov 2026) - [CVE-2026-123864: Node.js HTTPS memory disclosure via TLS write re-entrancy](https://junglewise.ai/threats/cve-2026-123864-a-re-entrancy-flaw-in-node-js-https-lets-an-unauthenticated) (high, CVSS 8.1, published 11 Nov 2026) - [CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of service](https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-120474: undici cross-user cache disclosure via same-origin redirect](https://junglewise.ai/threats/cve-2026-120474-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-120423: undici Subresource Integrity bypass via whitespace in integrity metadata](https://junglewise.ai/threats/cve-2026-120423-undici-is-an-http-client-for-node-js-in-versions-7-15-0-through) (medium, CVSS 5.9, published 6 Nov 2026) - [CVE-2026-120222: undici denial of service via unhandled exception in cache-interceptor](https://junglewise.ai/threats/cve-2026-120222-undici-is-an-http-client-for-node-js-in-versions-7-0-0-through-7) (medium, CVSS 5.9, published 6 Nov 2026) - [CVE-2026-116592: undici cache poisoning and cross-user disclosure via intermediate redirect](https://junglewise.ai/threats/cve-2026-116592-undici-is-an-http-client-for-node-js-in-versions-7-30-1-and-8-12) (high, CVSS 7.4, published 6 Nov 2026) - [CVE-2026-120216: Fastify denial of service via uncaught exception on handlerTimeout with streaming responses](https://junglewise.ai/threats/cve-2026-120216-fastify-is-a-web-framework-for-node-js-in-versions-5-8-0-through) (medium, CVSS 5.9, published 2 Nov 2026) - [CVE-2026-120213: @fastify/http-proxy prefix escape via decoded route parameters](https://junglewise.ai/threats/cve-2026-120213-fastify-http-proxy-is-a-fastify-plugin-that-proxies-http) (critical, CVSS 9.1, published 2 Nov 2026) - [CVE-2026-117549: @fastify/secure-session signature verification bypass via cookie signature removal](https://junglewise.ai/threats/cve-2026-117549-fastify-secure-session-is-a-session-plugin-for-fastify-that) (medium, CVSS 4.2, published 2 Nov 2026) - [CVE-2026-117518: @fastify/reply-from path traversal via backslash dot-segment escape](https://junglewise.ai/threats/cve-2026-117518-fastify-reply-from-is-a-fastify-plugin-that-forwards-requests-to) (high, CVSS 8.2, published 2 Nov 2026) - [CVE-2026-112362: @fastify/express path-scoped middleware bypass via absolute-form requests](https://junglewise.ai/threats/cve-2026-112362-fastify-express-is-a-fastify-plugin-that-runs-express-middleware) (critical, CVSS 9.1, published 27 Oct 2026) - [CVE-2026-106074: Node.js crypto entropy cache reuse in snapshots](https://junglewise.ai/threats/cve-2026-106074-a-flaw-in-node-js-crypto-causes-the-internal-entropy-caches-used) (medium, CVSS 4.8, published 23 Oct 2026) - [CVE-2026-106072: Node.js TLS certificate hostname verification bypass with non-canonical IPv4](https://junglewise.ai/threats/cve-2026-106072-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate) (medium, CVSS 6.7, published 23 Oct 2026) - [CVE-2026-106069: Node.js TLS hostname verification bypass with non-canonical IPv4](https://junglewise.ai/threats/cve-2026-106069-a-flaw-in-node-js-tls-hostname-verification-can-cause-a-server) (high, CVSS 7.4, published 23 Oct 2026) - [CVE-2026-105483: Node.js TLS certificate hostname verification bypass with fullwidth digits](https://junglewise.ai/threats/cve-2026-105483-a-flaw-in-node-js-tls-hostname-verification-allows-a-certificate) (high, CVSS 7.4, published 23 Oct 2026) ## Most severe OpenJS Foundation vulnerabilities - [CVE-2023-5217: Electron heap buffer overflow in libvpx vp8 encoding](https://junglewise.ai/threats/cve-2023-5217-google-chromium-libvpx-heap-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 28 Sep 2023) - [CVE-2026-92395: @fastify/proxy-addr IP spoofing via IPv4-mapped IPv6 trust subnet](https://junglewise.ai/threats/cve-2026-92395-fastify-proxy-addr-ip-spoofing-via-ipv4-mapped-ipv6-trust-subnet) (critical, CVSS 9.1, published 16 Sep 2026) - [CVE-2026-120213: @fastify/http-proxy prefix escape via decoded route parameters](https://junglewise.ai/threats/cve-2026-120213-fastify-http-proxy-is-a-fastify-plugin-that-proxies-http) (critical, CVSS 9.1, published 2 Nov 2026) - [CVE-2026-112362: @fastify/express path-scoped middleware bypass via absolute-form requests](https://junglewise.ai/threats/cve-2026-112362-fastify-express-is-a-fastify-plugin-that-runs-express-middleware) (critical, CVSS 9.1, published 27 Oct 2026) - [CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of service](https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets) (high, CVSS 8.2, published 11 Nov 2026) - [CVE-2026-117518: @fastify/reply-from path traversal via backslash dot-segment escape](https://junglewise.ai/threats/cve-2026-117518-fastify-reply-from-is-a-fastify-plugin-that-forwards-requests-to) (high, CVSS 8.2, published 2 Nov 2026) - [CVE-2026-102674: Electron sandbox escape via popup windows in top-level document](https://junglewise.ai/threats/cve-2026-102674-electron-is-a-framework-for-writing-cross-platform-desktop) (high, CVSS 8.2, published 29 Sep 2026) - [CVE-2026-92087: @fastify/auth authorization bypass via order-dependent evaluation](https://junglewise.ai/threats/cve-2026-92087-fastify-auth-authorization-bypass-via-order-dependent-evaluation) (high, CVSS 8.1, published 16 Sep 2026) - [CVE-2026-18500: @fastify/jwt authorization bypass via global secret override](https://junglewise.ai/threats/cve-2026-18500-fastify-jwt-authorization-bypass-via-global-secret-override) (high, CVSS 8.1, published 15 Aug 2026) - [CVE-2026-123872: Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a) (high, CVSS 8.1, published 11 Nov 2026) ## Vulnerabilities per week 24 vulnerabilities in the last four weeks, up 380% on the four before (5). 2 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 8 | 0 | 0 | | 19 Oct 2026 | 7 | 0 | 0 | | 26 Oct 2026 | 1 | 1 | 0 | | 2 Nov 2026 | 8 | 1 | 0 | | 9 Nov 2026 | 12 | 0 | 0 | ## OpenJS Foundation technologies - [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js): 18 vulnerabilities - [OpenJS Foundation Multer](https://junglewise.ai/threats/technologies/multer): 14 vulnerabilities - [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici): 12 vulnerabilities - [OpenJS Foundation Electron](https://junglewise.ai/threats/technologies/openjs-foundation-electron): 11 vulnerabilities - [OpenJS Foundation Morgan](https://junglewise.ai/threats/technologies/morgan): 4 vulnerabilities - [OpenJS Foundation Body-Parser](https://junglewise.ai/threats/technologies/body-parser): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenJS Foundation vulnerabilities", https://junglewise.ai/threats/vendors/openjs-foundation, 12 November 2026.