CVE-2026-106073

Vendor

Node.js

Product

Node.js

CVSS

3.3

EPSS

0.005 (p41)

Exposure class

Developer platform, Network management

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 51
   Advisory Fortinet PSIRT 6d ago

   Node2Shell CVEs

   CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

   CVSS 9.8 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
2. 24
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js
3. 21
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…

   No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
4. 17
   CVE NVD 8d ago

   A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.

   A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a…

   CVSS 3.3 CVE-2026-106073 Node.js