Vulnerabilities

The BalancedPool constructor in the undici HTTP client library deep-clones its options object by serializing and reparsing it as JSON, which silently discards any function-valued TLS options such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option. An application that relies on such a callback to enforce custom certificate checks will accept a server certificate that the callback was written to reject, provided the certificate still passes Node.js's default hostname and chain checks, enabling server impersonation or man-in-the-middle attacks with confidentiality and integrity impact. Only applications running undici 7.24.1 through 7.29.0 or 8.0.0 through 8.10.1 that pass function-valued connect or tls options to BalancedPool are affected; the Client, Pool, and Agent dispatchers are unaffected because they extract those options before cloning. There is no public proof-of-concept, no report of exploitation in the wild, the CVE is not in CISA's KEV, and EPSS assigns a 0.1% probability of exploitation within 30 days.

Do: Upgrade undici to 7.29.1 (for the 7.x line) or 8.10.2 (for the 8.x line). As interim mitigations, replace BalancedPool with the unaffected Pool or Agent dispatchers, or avoid passing function-valued connect/tls options (e.g. checkServerIdentity or custom connectors) to BalancedPool. Audit application code and dependencies for BalancedPool usage combined with custom TLS validation callbacks to determine whether custom certificate checks are currently being bypassed.

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.

A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.

A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool's origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination. This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP. Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin. This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0. Patches: Upgrade to undici v7.26.0 or v8.2.0. Workarounds: Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be injected inside a $nor clause without being sanitized. This vulnerability is fixed in 6.13.9, 7.8.9, 8.22.1, and 9.1.6.

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?raw (or ?inline) to retrieve the contents of arbitrary files on the server as a JavaScript string (e.g., export default "..."). The access control enforced in the HTTP request path (such as server.fs.allow) is not applied to this WebSocket-based execution path. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

CVE-2026-21710 is a denial-of-service flaw (CWE-843 type confusion, also tagged CWE-770) in the HTTP request handling of Node.js release lines 20.x, 22.x, 24.x, and 25.x, triggered when a client sends a request with a header literally named `__proto__` and the application reads `req.headersDistinct`. Because the header collides with JavaScript's prototype mechanism, `dest["__proto__"]` resolves to Object.prototype instead of undefined, causing the code to call `.push()` on a non-array and throw a synchronous TypeError. The exception is thrown inside a property getter and is not routed through the request's `error` event, so an attacker's single crafted request crashes request handling and yields availability impact (CVSS 7.5, availability-only) unless every `req.headersDistinct` access is wrapped in try/catch. All applications running HTTP servers on affected Node.js versions are exposed, including Node.js as shipped in Red Hat Enterprise Linux and RHEL Extended Update Support (EUS), although only code paths that actually read `req.headersDistinct` can be crashed by this trigger. No public proof-of-concept or confirmed exploitation exists yet, but the EPSS score of 25% within 30 days (98th percentile) indicates elevated near-term exploitation risk.

Do: Upgrade Node.js to the latest patched release published for your current release line (20.x, 22.x, 24.x, or 25.x) once fixes ship, and apply the corresponding updated nodejs packages from Red Hat advisories for RHEL and RHEL EUS systems. As interim mitigation, wrap every `req.headersDistinct` access in try/catch or reject/strip requests containing a `__proto__` header at a reverse proxy. Prioritize remediation given the high EPSS (25% probability of exploitation within 30 days).

Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination. The vulnerability exists because: * The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15 * The createInflateRaw() call is not wrapped in a try-catch block * The resulting exception propagates up through the call stack and crashes the Node.js process