Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
node.js Number Of NVD 149 CRITICAL 13 HIGH 91 MEDIUM 44 LOW 1
URL https://nodejs.org/
Explanation Node.js releases a major version every 6 months.

The status of each version includes

Current : Added features

Active LTS : New stable features, bug fixes, and other updates are made by the LTS team.

Maintenance LTS : New features are added, major bug fixes and security updates are made by the LTS team. New features will only be added if they can be migrated to subsequent versions.

Odd-numbered releases (9, 11, etc.) will be Current and will be supported by the developers for 6 months only.
Even-numbered releases (10, 12, etc.) will be released after support for odd-numbered releases expires, and will be supported as Current for 6 months by the developers.
After 6 months of even-numbered releases, the system will move to Active LTS for 12 months and become generally available.
After the end of Active LTS, the system will move to Maintenance LTS for 12 months.
Even-numbered releases are usually guaranteed to have critical bugs fixed for a total of 30 months.

Only Active LTS and Maintenance LTS Node.js should be used in commercial products.
Tag
  • MIT License
  • Javascript

Add Information URL
No Type Name URL
1 https://nodejs.org/en/blog/
2 https://nodejs.org/en/blog/release/
3 https://nodejs.org/en/about/releases/
4 https://github.com/nodejs/Release

List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support
Extended
for a fee
Critical High Medium Low
51 Node.js 22 v22.6.0 Aug. 6, 2024 June 11, 2024 0 0 0 0
52 Node.js 21 21.7.3 April 10, 2024 Oct. 17, 2023 0 0 0 0
53 Node.js 20 20.14.0 May 28, 2024 April 19, 2023 2 12 3 0
54 Node.js 19 19.7.0 Feb. 21, 2023 Oct. 18, 2022 0 5 2 0
55 Node.js 18 (LTS) 18.15.0 March 7, 2023 April 19, 2022 Oct. 18, 2023 April 30, 2025 2 15 8 0
56 Node.js 17 17.9.1 June 2, 2022 Oct. 19, 2021 April 1, 2022 June 1, 2022 0 3 2 0
57 Node.js 16 (LTS) 16.19.1 Feb. 16, 2023 April 20, 2021 Oct. 18, 2022 April 30, 2024 4 16 12 0
58 Node.js 15 15.14.0 April 6, 2021 Oct. 20, 2020 June 1, 2021 1 6 3 0
59 Node.js 14 (LTS) 14.21.3 Feb. 16, 2023 April 21, 2020 Oct. 18, 2021 April 30, 2023 3 22 13 0
60 Node.js 13 13.14.0 April 30, 2020 Oct. 22, 2019 June 1, 2020 2 1 0 0
61 Node.js 12 (LTS) 12.22.12 April 5, 2022 April 23, 2019 Oct. 21, 2019 April 30, 2022 4 24 9 0
62 Node.js 11 11.15.0 April 30, 2019 Oct. 23, 2018 June 1, 2019 0 4 5 0
63 Node.js 10 (LTS) 10.24.1 April 6, 2021 April 24, 2018 May 18, 2020 April 30, 2021 2 28 10 0
64 Node.js 9 9.11.2 June 12, 2018 Oct. 1, 2017 June 30, 2018 1 8 4 1
65 Node.js 8 (LTS) 8.17.0 Dec. 17, 2019 May 30, 2017 Dec. 31, 2018 Dec. 31, 2019 1 23 9 1
66 Node.js 7 7.10.1 July 11, 2017 Oct. 25, 2016 June 30, 2017 2 7 4 0
67 Node.js 6 (LTS) 6.17.1 April 3, 2019 Oct. 18, 2016 April 29, 2018 April 30, 2019 4 24 16 0
68 Node.js 5 5.12.0 June 23, 2016 Oct. 29, 2015 June 30, 2016 1 16 8 0
69 Node.js 4 (LTS) 4.9.1 March 30, 2018 Sept. 8, 2015 March 30, 2017 April 30, 2018 April 1, 2017 6 25 13 0
70 Node.js 3.0 3.0.0 0 5 3 0
71 Node.js 2.0 2.0.2 0 5 3 0
72 Node.js 1 1.1.0 0 10 10 0
73 Node.js 0 0.0.6 2 22 16 0
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2
Level
Attach Vector
Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date
Show Affected Exploit
PoC
Search
51 6.5
6.4
MEDIUM
Network
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies th… CWE-444
HTTP Request Smuggling
CVE-2020-8287 cpe:2.3:a:nodejs:node.js:*:* 14.0.0
12.0.0
10.0.0
15.0.0






14.15.4
12.20.1
10.23.1
15.5.1
2024-11-21 14:38
2021-01-7
Show GitHub Exploit DB Packet Storm
52 8.1
6.8
HIGH
Network
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::T… CWE-416
 Use After Free
CVE-2020-8265 cpe:2.3:a:nodejs:node.js:*:* 14.0.0
12.0.0
10.0.0
15.0.0






14.15.4
12.20.1
10.23.1
15.5.1
2024-11-21 14:38
2021-01-7
Show GitHub Exploit DB Packet Storm
53 5.9
4.3
MEDIUM
Network
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares d… CWE-476
 NULL Pointer Dereference
CVE-2020-1971 cpe:2.3:a:nodejs:node.js:*:* 14.15.0
12.13.0
10.13.0
14.0.0
10.0.0
12.0.0
15.0.0



14.14.0
10.12.0
12.12.0






14.15.4
12.20.1
10.23.1



15.5.0
2024-11-21 14:11
2020-12-9
Show GitHub Exploit DB Packet Storm
54 6.5
5.8
MEDIUM
Network
Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when us… CWE-125
Out-of-bounds Read
CVE-2018-21270 cpe:2.3:a:nodejs:node.js:*:* 0.0.6 2024-11-21 13:03
2020-12-4
Show GitHub Exploit DB Packet Storm
55 7.5
5.0
HIGH
Network
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the appli… CWE-400
 Uncontrolled Resource Consumption
CVE-2020-8277 cpe:2.3:a:nodejs:node.js:*:* 14.13.0
12.16.3
15.0.0




14.15.1
12.19.1
15.2.1
2024-11-21 14:38
2020-11-19
Show GitHub Exploit DB Packet Storm
56 7.8
4.6
HIGH
Local
The implementation of realpath in libuv < 10.22.1, < 12.18.4, and < 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is lon… CWE-120
Classic Buffer Overflow
CVE-2020-8252 cpe:2.3:a:nodejs:node.js:*:* 12.0.0
10.0.0
14.0.0




12.18.4
10.22.1
14.9.0
2024-11-21 14:38
2020-09-19
Show GitHub Exploit DB Packet Storm
57 7.5
5.0
HIGH
Network
Node.js < 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections. CWE-400
 Uncontrolled Resource Consumption
CVE-2020-8251 cpe:2.3:a:nodejs:node.js:*:* 14.0.0 14.11.0 2024-11-21 14:38
2020-09-19
Show GitHub Exploit DB Packet Storm
58 7.4
5.8
HIGH
Network
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions,… CWE-444
HTTP Request Smuggling
CVE-2020-8201 cpe:2.3:a:nodejs:node.js:*:* 12.0.0
14.0.0


12.18.4
14.11.0
2024-11-21 14:38
2020-09-19
Show GitHub Exploit DB Packet Storm
59 8.1
9.3
HIGH
Network
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0. CWE-191
 Integer Underflow (Wrap or Wraparound)
CVE-2020-8174 cpe:2.3:a:nodejs:node.js:*:* 14.0.0

12.0.0




14.4.0
10.21.0
12.18.0
2024-11-21 14:38
2020-07-25
Show GitHub Exploit DB Packet Storm
60 7.4
5.8
HIGH
Network
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0. CWE-295
Improper Certificate Validation 
CVE-2020-8172 cpe:2.3:a:nodejs:node.js:*:* 12.0.0
14.0.0


12.18.0
14.4.0
2024-11-21 14:38
2020-06-8
Show GitHub Exploit DB Packet Storm