[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXJM83a35xJCgfeNTf8HtLoUcBupUTW_rE9G9lF5_42g":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":33,"kevVulnerabilities":89,"topProductsByCves":94,"seoMetadata":98,"meta":107},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":32},21912,"nodejs",3,171,1,1129,"2025-01-28","n",[16,21,28],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},119506,"node.js",872,157,{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":26,"last_cve_update":27},119508,"undici",188,12,0,"2024-04-04",{"id":29,"product_name":8,"version_count":30,"cve_count":9,"kev_count":26,"last_cve_update":31},119507,69,"2014-09-05","Nodejs is a technology vendor with 3 tracked products and 171 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[34,42,49,54,59,63,70,75,79,83],{"cveId":35,"description":36,"publishedDate":37,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":4,"epssScore":41},"CVE-2023-44487","The HTTP\u002F2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","2023-10-10",7.5,"v3.1","High",0.99999,{"cveId":43,"description":44,"publishedDate":45,"cvssScore":46,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":48},"CVE-2014-0224","OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.","2014-06-05",7.4,false,0.95326,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":53},"CVE-2016-2183","The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.","2016-09-01",0.94697,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":58},"CVE-2022-3786","A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.\n\n","2022-11-01",0.92488,{"cveId":60,"description":61,"publishedDate":57,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":62},"CVE-2022-3602","A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform\u002Fcompiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).",0.9077,{"cveId":64,"description":65,"publishedDate":66,"cvssScore":67,"cvssVersion":39,"severity":68,"isKev":47,"epssScore":69},"CVE-2016-2107","The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.","2016-05-05",5.9,"Medium",0.89058,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":74},"CVE-2019-9515","Some HTTP\u002F2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.","2019-08-13",0.87399,{"cveId":76,"description":77,"publishedDate":73,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":78},"CVE-2019-9512","Some HTTP\u002F2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP\u002F2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.",0.83433,{"cveId":80,"description":81,"publishedDate":73,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":47,"epssScore":82},"CVE-2019-9514","Some HTTP\u002F2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.",0.82813,{"cveId":84,"description":85,"publishedDate":86,"cvssScore":87,"cvssVersion":39,"severity":68,"isKev":47,"epssScore":88},"CVE-2022-32214","The llhttp parser \u003Cv14.20.1, \u003Cv16.17.1 and \u003Cv18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).","2022-07-14",6.5,0.81832,[90],{"cveId":35,"description":36,"publishedDate":37,"cvssScore":38,"cvssVersion":39,"severity":40,"isKev":4,"epssScore":41,"cisaVulnName":91,"cisaDateAdded":37,"cisaShortDescription":92,"cisaRequiredAction":93},"HTTP\u002F2 Rapid Reset Attack Vulnerability","HTTP\u002F2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",[95,96,97],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":25,"kev_count":26,"last_cve_update":27},{"id":29,"product_name":8,"version_count":30,"cve_count":9,"kev_count":26,"last_cve_update":31},{"title":99,"metaDescription":100,"keywords":101,"structuredData":102},"Nodejs - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Nodejs covering 3 products with 171 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Nodejs vulnerabilities, Nodejs security, Nodejs CVE, Nodejs threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Nodejs KEV, Nodejs exploited vulnerabilities",{"@context":103,"@type":104,"name":105,"description":100,"url":106},"https:\u002F\u002Fschema.org","Organization","Nodejs","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnodejs",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":108,"apiVersion":109},"2026-10-16T23:55:02.383Z","3.0"]