CVE-2026-105481

Vendor

Node.js

Product

Node.js

CVSS

6.5

EPSS

0.005 (p41)

Exposure class

Developer platform, Network management

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 51
   Advisory Fortinet PSIRT 6d ago

   Node2Shell CVEs

   CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

   CVSS 9.8 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
2. 24
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js
3. 20
   CVE NVD 8d ago

   A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request.

   A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle…

   CVSS 6.5 CVE-2026-105481 Node.js
4. 21
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…

   No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js