products / nodejs

Node.js

Node.js is the V8-based JavaScript runtime used for APIs, CLIs, and agent backends. CVE volume is large because upstream V8, libuv, and OpenSSL issues land as Node CVEs alongside core HTTP and permission bugs. Attestd filters NVD results through cpe:2.3:a:nodejs:node.js. The alternate nodejs:nodejs namespace adds noise without improving eligibility, so ingestion uses the single canonical CPE prefix.

api usage

Querying Node.js

product slugnodejs

version format18.0.0, 22.14.0, 20.8.1

bash

curl "https://api.attestd.io/v1/check?product=nodejs&version=18.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Node.js 18.0.0 is an early Node 18 release that overlaps multiple CVE ranges, including experimental permission-model path traversal (CVE-2023-39332) and policy bypass issues on adjacent lines. The response aggregates those ranges into a high risk state with a patch available later on the 18.x line.

json

{
  "product": "nodejs",
  "version": "18.0.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-32212",
    "CVE-2022-32213",
    "CVE-2022-32214",
    "CVE-2022-32215",
    "CVE-2022-32222",
    "CVE-2022-32223",
    "CVE-2022-35255",
    "CVE-2022-35256",
    "CVE-2022-3602",
    "CVE-2022-3786",
    "CVE-2022-43548",
    "CVE-2023-23918",
    "CVE-2023-23919",
    "CVE-2023-23920",
    "CVE-2023-23936",
    "CVE-2023-30581",
    "CVE-2023-30585",
    "CVE-2023-30588",
    "CVE-2023-30589",
    "CVE-2023-30590",
    "CVE-2023-32002",
    "CVE-2023-32006",
    "CVE-2023-32559",
    "CVE-2023-38552",
    "CVE-2023-44487",
    "CVE-2024-21892",
    "CVE-2024-22019",
    "CVE-2024-27983",
    "CVE-2024-3566",
    "CVE-2025-23084",
    "CVE-2026-21637",
    "CVE-2026-64806"
  ],
  "cves": null,
  "max_epss": 0.99999,
  "last_updated": "2026-08-16T05:52:54.417900Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Node.js 22.14.0 is a current 22.x release past the 16/18/20 cut lines for the permission-model, policy, and llhttp CVEs listed below.

bash

curl "https://api.attestd.io/v1/check?product=nodejs&version=22.14.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Node.js CVEs mix experimental security features (policy files, permission model) with HTTP parsing and Windows install-path issues. High-scoring entries often land as coordinated releases across the active LTS lines rather than a single version string.

CVE	Description	Affects	CVSS
`CVE-2023-32002`	Module._load() bypasses the experimental policy mechanism and loads modules outside policy.json.	16/18/20 early	9.8
`CVE-2023-39332`	Non-Buffer Uint8Array paths bypass experimental permission-model path traversal checks.	20.x <20.8.1	9.8
`CVE-2023-30589`	llhttp accepts bare CR as a header delimiter and enables HTTP request smuggling.	16/18/20 cuts	7.5
`CVE-2021-22921`	Improper Windows install-directory permissions allow PATH/DLL hijacking for local privilege escalation.	12/14/16 cuts	7.8

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Canonical CPE namespace

NVD lists Node.js under more than one product string. Attestd uses the canonical identifier that carries the usable version ranges:

cpe:2.3:a:nodejs:node.jsCanonical Node.js runtime CVEs

cpe:2.3:a:nodejs:nodejsAlternate spelling; not used for matching

Querying only the alternate namespace misses or duplicates ranges. Attestd matches against nodejs:node.js so a single API call covers the runtime product family.

All products Deno vm2 Quickstart