[UPDATE] [medium] Node.js: Multiple vulnerabilities

mediumCVE-2024-36137 CVE-2026-21637 CVE-2026-21710 CVE-2026-21711 CVE-2026-21712 CVE-2026-21713

An attacker can exploit multiple vulnerabilities in Node.js to cause a denial of service, bypass security measures, and disclose information.

CSIRTS triage

vendor: Node.js product: Node.js Denial of service Authentication bypass Information disclosure

What: Multiple vulnerabilities can allow an attacker to cause denial of service, bypass security measures, and disclose information.
Who is affected: All deployments of Node.js are affected by these vulnerabilities.
Urgency: Remediation is medium urgency due to the potential impact of the vulnerabilities.
Action: Update to the latest version of Node.js to mitigate these vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Node.js

Get an email when a new Node.js advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-07-02
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0843

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2024-361370.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-216371.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 63% of all EPSS-scored CVEs.
Elevated exploitation riskCVE-2026-2171025.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217110.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217120.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217130.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 32% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217140.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217150.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217160.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-217170.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-36137	coverage & exploitation status	NVD · CVE.org
CVE-2026-21637	coverage & exploitation status	NVD · CVE.org
CVE-2026-21710	coverage & exploitation status	NVD · CVE.org
CVE-2026-21711	coverage & exploitation status	NVD · CVE.org
CVE-2026-21712	coverage & exploitation status	NVD · CVE.org
CVE-2026-21713	coverage & exploitation status	NVD · CVE.org
CVE-2026-21714	coverage & exploitation status	NVD · CVE.org
CVE-2026-21715	coverage & exploitation status	NVD · CVE.org
CVE-2026-21716	coverage & exploitation status	NVD · CVE.org
CVE-2026-21717	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-21710: A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is recei…msrc
mediumCVE-2026-21717: A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their nume…msrc
unknownMultiple vulnerabilities in Oracle PeopleSoft (July 23, 2026)cert-fr-avis
high[UPDATE] [high] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
critical[UPDATE] [critical] Node.js: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in Tenable Identity Exposure (June 24, 2026)cert-fr-avis

Recent advisories for Node.js

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-55553: urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and ot…nvd · 2026-08-25
highCVE-2026-76842: The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths w…nvd · 2026-08-24
highCVE-2026-76172: fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the s…nvd · 2026-08-24
highCVE-2026-75975: fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not v…nvd · 2026-08-24
highCVE-2026-75931: fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the …nvd · 2026-08-24
highCVE-2026-75899: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing …nvd · 2026-08-24