CVE-2023-32558None▾ SunlitThe use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.7%
The use of the deprecated API process.binding() can bypass the permission model through path traversal.
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Node >= 4.0 < 4.*Node >= 5.0 < 5.*Node >= 6.0 < 6.*Node >= 7.0 < 7.*Node >= 8.0 < 8.*Node >= 9.0 < 9.*Node >= 10.0 < 10.*Node >= 11.0 < 11.*Node >= 12.0 < 12.*Node >= 13.0 < 13.*Node >= 14.0 < 14.*Node >= 15.0 < 15.*Node >= 17.0 < 17.*Node >= 19.0 < 19.*Node >= 20.0 < 20.5.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-30588NoneWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application proce…
CVE-2026-106071Low· 3.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the r…
CVE-2026-106072Medium· 6.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`…
CVE-2026-106073Low· 3.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks
CVE-2026-106070Low· 3.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does …
CVE-2026-105483High· 7.4A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`)…