UlisesGascon

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA

Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown

Node.js is vulnerable to a zlib denial of service via a stream destroy during a pending params() call

Node.js is vulnerable to Permission Model file-name disclosure via recursive fs.watch

Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin

undici vulnerable to cross-user cache disclosure via same-origin redirect

undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata