CVE-2026-106074

Vendor

Node.js

Product

Node.js

CVSS

4.8

EPSS

0.005 (p41)

Exposure class

Developer platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 51
   Advisory Fortinet PSIRT 6d ago

   Node2Shell CVEs

   CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

   CVSS 9.8 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
2. 24
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js
3. 20
   CVE NVD 8d ago

   A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be…

   A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single…

   CVSS 4.8 CVE-2026-106074 Node.js