Vulnerability history

Permission Model Bypass via fs.realpathSync() Path Probing

Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup

Exposure of Sensitive Information via Cached Invalid ZIP Local Headers

Improper Certificate Validation for Non-Canonical IPv4 Hostnames

HTTP Response Desynchronization on Pooled Keep-Alive Sockets

Out-of-Bounds Write in the Bundled Brotli Decoder leading to Remote Code Execution

Improper Certificate Validation via Non-Canonical IP Hostnames

Improper Certificate Validation via Fullwidth-Digit IP Hostnames (checkServerIdentity bypass)

Improper Null Termination in dns.resolve() leading to Hostname Spoofing

Use of Insufficiently Random Values via Entropy Caches Retained in Startup Snapshots and SEAs