[UPDATE] [high] Node.js: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Node.js to bypass security precautions, manipulate data, disclose confidential information, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities allow an attacker to bypass security precautions and manipulate data.
- Who is affected
- Deployments of Node.js.
- Urgency
- Remediation is high urgency due to the potential for exploitation.
- Action
- Update to the latest version of Node.js.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Node.js
Get an email when a new Node.js advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2004
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-216360.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all scored CVEs.
- Low exploitation riskCVE-2026-486150.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.
- Low exploitation riskCVE-2026-486170.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
- Low exploitation riskCVE-2026-486180.67% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 48% of all scored CVEs.
- Low exploitation riskCVE-2026-486190.66% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all scored CVEs.
- Low exploitation riskCVE-2026-489280.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
- Low exploitation riskCVE-2026-489300.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-489310.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
- Moderate exploitation riskCVE-2026-489332.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 85% of all scored CVEs.
- Low exploitation riskCVE-2026-489340.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-21636 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48615 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48617 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48618 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48619 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48928 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48930 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48931 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48933 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48934 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48935 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48936 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-48937 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- critical[UPDATE] [critical] Node.js: Multiple vulnerabilitiescert-bund
- lowCVE-2026-48936: A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain soc…nvd
- lowCVE-2026-48935: A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that …nvd
- mediumCVE-2026-48934: A flaw in Node.js TLS host verification can cause an attacker to bypass certification validati…nvd
- highCVE-2026-48933: A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encry…nvd
- criticalCVE-2026-48930: A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent au…nvd
- mediumCVE-2026-48928: A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context …nvd
- highCVE-2026-48619: A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, …nvd
- mediumCVE-2026-48618: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can l…nvd
- highCVE-2026-48615: A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUN…nvd
- unknownNode.js Multiple Vulnerabilitieshkcert
Recent advisories for Node.js
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-59817: Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donati…nvd · 2026-07-09
- unknownCVE-2026-57481: Parse Server is an open source backend that can be deployed to any infrastructure that can run…nvd · 2026-07-08
- unknownCVE-2026-57480: Parse Server is an open source backend that can be deployed to any infrastructure that can run…nvd · 2026-07-08
- unknownCVE-2026-55778: Parse Server is an open source backend that can be deployed to any infrastructure that can run…nvd · 2026-07-08
- mediumCVE-2026-59875: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not…nvd · 2026-07-08
- highCVE-2026-59874: node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accep…nvd · 2026-07-08
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] DENX U-Boot: Multiple vulnerabilities allow execution of arbitrary code and DoS2026-07-10
- medium[NEW] [medium] Samsung Android: Multiple vulnerabilities2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10