Windows apps · Node.js Foundation
Node.js 6 security updates
The latest version of Node.js 6 is 6.17.0, released February 28, 2019. Patch Radar has 5 security fixes for Node.js 6, closing 18 CVEs. The newest is Node.js 6 6.17.0 (6.17.0), released February 28, 2019. 15 CVEs have no fix yet.
15 with no fix yet
Latest version
6.17.0
Released Feb 28, 2019
Security fixes
5
On record in Patch Radar
CVEs
18
Closed by those fixes
Exploited
0
Vendor report or CISA KEV
CVEs with no fix yet
| Priority | CVE | Title | Status |
|---|---|---|---|
| Urgent | CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | no-fix |
| High | CVE-2020-8174 | Node.js 4 and 5 others: Memory Corruption - Generic (CWE-119) | no-fix |
| High | CVE-2021-44531 | Node.js 14 and 8 others: Improper Certificate Validation (CWE-295) | no-fix |
| High | CVE-2021-44532 | Node.js 14 and 8 others: Improper Following of a Certificate's Chain of Trust (CWE-296) | no-fix |
| High | CVE-2021-44533 | Node.js 14 and 8 others: Improper Certificate Validation (CWE-295) | no-fix |
| High | CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**. | no-fix |
| High | CVE-2026-21637 | HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers | no-fix |
| High | CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | no-fix |
| High | CVE-2026-21711 | Node.js 14 and 12 others: Improper Access Control | no-fix |
| High | CVE-2026-21713 | Node.js 14 and 15 others: Observable Timing Discrepancy | no-fix |
| High | CVE-2026-21714 | Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime | no-fix |
| High | CVE-2026-21715 | Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource | no-fix |
| High | CVE-2026-21716 | Node.js 14 and 15 others: Missing Authorization | no-fix |
| High | CVE-2026-21717 | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | no-fix |
| Routine | CVE-2026-106070 | Node.js and 17 others: Business Logic Errors | no-fix |
Security fixes, newest first
| Priority | Fix | Fixed in | CVEs | Exploited | Released |
|---|---|---|---|---|---|
| High | Node.js 6 6.17.0 | 6.17.0 | 13 | Feb 28, 2019 | |
| Urgent | Node.js 6 6.12.2 | 6.12.2 | 2 | Dec 7, 2017 | |
| High | Node.js 6 6.11.5 | 6.11.5 | 1 | Oct 24, 2017 | |
| High | Node.js 6 6.11.2 | 6.11.2 | 1 | Aug 1, 2017 | |
| High | Node.js 6 6.11.1 | 6.11.1 | 1 | Jul 10, 2017 |