Generated stack · OpenJS Foundation
Node.js
JavaScript runtime under most vibe-coded backends, API routes and serverless functions.
3Advisories
1critical
2high
0medium
2026-11-10Latest
Node.js CVEs & security
Is Node.js safe?
Node.js is the runtime under most JavaScript backends, API routes and serverless functions, so its security releases affect most AI-built apps too.
We track 3 security advisories that affect Node.js. By severity: 1 critical and 2 high. All of them have a CVE ID. The most common kind is code execution (2). The newest entry is dated 2026-11-10.
Newest entries on this page
- CVE-2026-120012: SAP Cloud SDK for AI (Node.js) can leak auth credentials into error messages, fixed in @sap-ai-sdk/ai-api 2.18.0 high 2026-11-10
- CVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev server critical 2026-10-21
- Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.x high 2026-10-21
Using Node.js safely
- Run a supported release line and upgrade to the latest patch. After the October 21, 2026 releases that is 22.23.4, 24.22.1 or 26.12.1.
- Check node -v everywhere it runs: your machine, CI and Docker base images, not just production.
- If a host manages Node.js for you, check which version it actually runs.
Timeline · advisories per quarter
32026 Q4
Named in sources
Reported for Node.js
01. CVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev serverWhile a vulnerable Storybook dev server is running and open in your browser, a malicious website can embed its preview and send events to it. With some user interaction this can change story files in your project, and if a changed file is later run, the attacker's code runs with your permissions. Storybook 8, 9, 10 and 11 alpha are affected, including @storybook/addon-mcp 10.6.x before 10.6.2. Patched in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6. Node.js 
MCP SDKs & servers 
Next.js 2026-10-21 02. CVE-2026-120012: SAP Cloud SDK for AI (Node.js) can leak auth credentials into error messages, fixed in @sap-ai-sdk/ai-api 2.18.0SAP's Node.js SDK for AI (@sap-ai-sdk/ai-api 2.17.0 and earlier) could include authentication credentials in error messages under certain failure conditions, so anyone who can read your logs or forwarded error output could reuse the token against the SAP service. Upgrade to 2.18.0, which stops logging the destination. Node.js 2026-11-10 03. Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.xNode.js shipped 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 CVEs. The four HIGH ones are a Brotli decoder out-of-bounds write that can lead to remote code execution, two TLS certificate hostname bypasses, and dns.resolve truncating names that contain a NUL byte. Any app running its own Node process should upgrade. Node.js Next.js 
Replit 2026-10-21
Node.js MCP SDKs & servers Next.js 2026-10-21 02. CVE-2026-120012: SAP Cloud SDK for AI (Node.js) can leak auth credentials into error messages, fixed in @sap-ai-sdk/ai-api 2.18.0SAP's Node.js SDK for AI (@sap-ai-sdk/ai-api 2.17.0 and earlier) could include authentication credentials in error messages under certain failure conditions, so anyone who can read your logs or forwarded error output could reuse the token against the SAP service. Upgrade to 2.18.0, which stops logging the destination. Node.js 2026-11-10 03. Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.xNode.js shipped 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 CVEs. The four HIGH ones are a Brotli decoder out-of-bounds write that can lead to remote code execution, two TLS certificate hostname bypasses, and dns.resolve truncating names that contain a NUL byte. Any app running its own Node process should upgrade. Node.js Next.js Replit 2026-10-21