Windows apps · Node.js Foundation
Node.js 7 security updates
The latest version of Node.js 7 is 7.1.0, released November 8, 2016. Patch Radar has 0 security fixes for Node.js 7, closing 0 CVEs. 24 CVEs have no fix yet.
24 with no fix yet
Latest version
7.1.0
Released Nov 8, 2016
Security fixes
0
On record in Patch Radar
CVEs
0
Closed by those fixes
Exploited
0
Vendor report or CISA KEV
CVEs with no fix yet
| Priority | CVE | Title | Status |
|---|---|---|---|
| Urgent | CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | no-fix |
| High | CVE-2016-9840 | Node.js 4 and 1 other: inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging… | no-fix |
| High | CVE-2016-9841 | Node.js 4 and 1 other: inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging… | no-fix |
| High | CVE-2016-9842 | Node.js 4 and 1 other: Incorrect Bitwise Shift of Integer | no-fix |
| High | CVE-2016-9843 | Node.js 4 and 1 other: The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified… | no-fix |
| High | CVE-2017-1000381 | Node.js 4 and 2 others: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered… | no-fix |
| High | CVE-2017-11499 | Node.js 4 and 2 others: Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0… | no-fix |
| High | CVE-2017-3731 | Truncated packet could crash via OOB read | no-fix |
| High | CVE-2020-8174 | Node.js 4 and 5 others: Memory Corruption - Generic (CWE-119) | no-fix |
| High | CVE-2021-44531 | Node.js 14 and 8 others: Improper Certificate Validation (CWE-295) | no-fix |
| High | CVE-2021-44532 | Node.js 14 and 8 others: Improper Following of a Certificate's Chain of Trust (CWE-296) | no-fix |
| High | CVE-2021-44533 | Node.js 14 and 8 others: Improper Certificate Validation (CWE-295) | no-fix |
| High | CVE-2026-21637 | HackerOne: CVE-2026-21637 TLS PSK/ALPN Callback Exceptions Bypass Error Handlers | no-fix |
| High | CVE-2026-21710 | A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | no-fix |
| Routine | CVE-2016-7055 | Node.js 4 and 1 other: There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL… | no-fix |
| Routine | CVE-2017-3732 | BN_mod_exp may produce incorrect results on x86_64 | no-fix |
| Routine | CVE-2026-106070 | Node.js and 17 others: Business Logic Errors | no-fix |
| Routine | CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**. | no-fix |
| Routine | CVE-2026-21711 | Node.js 14 and 12 others: Improper Access Control | no-fix |
| Routine | CVE-2026-21713 | Node.js 14 and 15 others: Observable Timing Discrepancy | no-fix |
| Routine | CVE-2026-21714 | Node.js 14 and 15 others: Missing Release of Memory after Effective Lifetime | no-fix |
| Routine | CVE-2026-21715 | Node.js 14 and 15 others: Incorrect Permission Assignment for Critical Resource | no-fix |
| Routine | CVE-2026-21716 | Node.js 14 and 15 others: Missing Authorization | no-fix |
| Routine | CVE-2026-21717 | A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process. The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table. This vulnerability affects **20.x, 22.x, 24.x, and 25.x**. | no-fix |