OpenJS Foundation

An unauthenticated attacker can crash Node.js applications using multer versions 2.0.0 through 2.4.0 by sending crafted multipart requests that trigger uncaught exceptions in the busboy parser after request teardown.

A vulnerability in the jQuery library allows remote, anonymous attackers to conduct a cross-site scripting (XSS) attack by exploiting DOM manipulation and event handling flaws.

The vm2 sandbox library (v3.11.3-3.11.6) allows attackers to bypass restrictions and execute arbitrary native code in the host process by calling crypto.setEngine() with a path to a malicious dynamic library.

A vulnerability in the Electron framework allows a <webview> tag to enable Node.js integration within Web Workers regardless of the embedder's restricted settings, potentially leading to unauthorized code execution.

The undici WebSocket client library is vulnerable to a denial-of-service attack (CVE-2026-19534) that crashes the Node.js process when a server returns an unrequested Sec-WebSocket-Protocol header.

Node.js contains multiple vulnerabilities enabling remote, unauthenticated attackers to execute arbitrary code, bypass security controls, perform denial-of-service, disclose sensitive information, manipulate files, or escalate privileges.

A vulnerability in Node.js allows a remote, unauthenticated attacker to trigger a Denial of Service condition, impacting the availability of applications running on the affected environment.

An incomplete fix for CVE-2024-29180 in webpack-dev-middleware allows path traversal via crafted URL requests when publicPath lacks a trailing slash, potentially leading to arbitrary local file read.

A vulnerability in Electron, identified as CVE-2026-70608, allows sandboxed iframes to bypass 'allow-popups' restrictions and open new windows via the OpenURL navigation path.

The undici library is susceptible to cache poisoning leading to information disclosure and application crashes due to improper handling of malformed Cache-Control directives in the cache interceptor.

This rule detects suspicious Node.js execution patterns on Windows systems, including user-writable runtimes, preload arguments, and inline eval, decode, or child-process usage, indicating potential malicious activity.