| react-profiling | 0 |
| react-import-map | react,react-dom,react-dom/client,react-dom/profiling,react-is,react-reconciler,react/compiler-runtime,react/jsx-dev-runtime,react/jsx-runtime,scheduler@d5750093facf |
| route-pattern | /:user_id/:repository/security(.:format) |
| route-controller | repos_security |
| route-action | overview |
| fetch-nonce | v2:aa08f7d6-282c-cc34-85d2-19545aab1495 |
| current-catalog-service-hash | eb4da4203caf235b905c6dc3e430904a1aa33592def963430bc11b0a1c2beee4 |
| request-id | C770:12AE65:3F5238:51E125:6AED2116 |
| html-safe-nonce | 493dc6ae5bf294b22dae5981e27e1a38ccdc42cb784670e9413a9488d0472f1b |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJDNzcwOjEyQUU2NTozRjUyMzg6NTFFMTI1OjZBRUQyMTE2IiwidmlzaXRvcl9pZCI6IjQzMjA4NzU5NjY0NTI1Mzk2NzAiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | dd6f4ab10c8cefeeb9aebbadf9e732a1d9d6c46440ce3810c02f1cd2110ec3d7 |
| hovercard-subject-tag | repository:1362723777 |
| github-keyboard-shortcuts | repository,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | ///repos/security/overview |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/positivef/node/security |
| og:site_name | GitHub |
| og:image | https://github.githubassets.com/assets/github-octocat-13c86b8b336d.png |
| og:image:type | image/png |
| og:image:width | 1200 |
| og:image:height | 620 |
| twitter:site:id | 13334762 |
| twitter:creator | github |
| twitter:creator:id | 13334762 |
| twitter:card | summary_large_image |
| twitter:image | https://github.githubassets.com/assets/github-logo-55c5b9a1fe52.png |
| twitter:image:width | 1200 |
| twitter:image:height | 1200 |
| hostname | github.com |
| expected-hostname | github.com |
| None | e3e0f7f63e50c6fe879198a93a0a023a648ecc0a5e9bc3b5e033ac57172237e6 |
| turbo-cache-control | no-preview |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 707a24b346ac8a82878b9c084efaa38a997660cb |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
| Skip to content | https://github.com/positivef/node/security#start-of-content |
| https://github.com/ |
| Sign in | https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpositivef%2Fnode%2Fsecurity |
| GitHubRepository hosting, code review, and collaboration | https://github.com/platform |
| CopilotAI coding agent for tasks, projects, and automated work | https://github.com/features/copilot |
| ActionsCI/CD and automation | https://github.com/features/actions |
| Code QualityQuality analysis, fixes, and enforcement | https://github.com/features/code-quality |
| CodespacesCloud development environments | https://github.com/features/codespaces |
| Code SecurityVulnerability detection and remediation | https://github.com/security/advanced-security/code-security |
| Secret ProtectionSecret scanning and leak prevention | https://github.com/security/advanced-security/secret-protection |
| All Features | https://github.com/features |
| Documentation | https://docs.github.com/en |
| Training | https://learn.github.com/skills |
| Certifications | https://learn.github.com/credentials |
| Build with Copilot | https://github.com/features/ai |
| Customize Copilot | https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview |
| Integrations | https://github.com/marketplace |
| Trending repos | https://github.com/trending |
| GitHub Sponsors | https://github.com/open-source/sponsors |
| Developer articles | https://github.com/resources/articles |
| ChangelogYour source for the latest features, improvements, and fixes across GitHub products, all in one place. | https://github.blog/changelog/ |
| Enterprises | https://github.com/enterprise |
| Team | https://github.com/team |
| Startups | https://github.com/enterprise/startups |
| Nonprofits | https://github.com/solutions/industry/nonprofits |
| Healthcare | https://github.com/solutions/industry/healthcare |
| Financial services | https://github.com/solutions/industry/financial-services |
| Manufacturing | https://github.com/solutions/industry/manufacturing |
| Government | https://github.com/solutions/industry/government |
| See all industries | https://github.com/solutions/industry |
| Why GitHub | https://github.com/why-github |
| Customer Stories | https://github.com/customer-stories |
| Business insights | https://github.com/solutions/executive-insights |
| Trust Center | https://github.com/trust-center |
| GitHub Advanced SecurityEnterprise-grade code security | https://github.com/security/advanced-security |
| Copilot for businessEnterprise-grade AI features | https://github.com/features/copilot/copilot-business |
| Premium SupportEnterprise-grade 24/7 support | https://github.com/enterprise/premium-support |
| Documentation | https://docs.github.com/en |
| Resource center | https://github.com/resources |
| Blog | https://github.blog/ |
| Events & webinars | https://github.com/resources/events |
| Community Forum | https://github.com/orgs/community/discussions |
| Customer Stories | https://github.com/customer-stories |
| Integrations | https://github.com/marketplace |
| Customer support | https://help.github.com/ |
| Training | https://learn.github.com/skills |
| GitHub Status | https://www.githubstatus.com/ |
| About | https://github.com/about |
| Partners | https://github.com/partners |
| Changelog | https://github.blog/changelog/ |
| GitHub UniverseThe event for developers, by developers — talks, workshops, and what’s next for GitHub. | https://githubuniverse.com/ |
| Pricing | https://github.com/pricing |
| Sign in | https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fpositivef%2Fnode%2Fsecurity |
| Sign up | https://github.com/signup?ref_cta=Sign+up&ref_loc=header+logged+out&ref_page=%2F%3Cuser-name%3E%2F%3Crepo-name%3E%2Frepos%2Fsecurity%2Foverview&source=header-repo&source_repo=positivef%2Fnode |
| Reload | https://github.com/positivef/node/security |
| Reload | https://github.com/positivef/node/security |
| Reload | https://github.com/positivef/node/security |
| positivef | https://github.com/positivef |
| node | https://github.com/positivef/node |
| Code | https://github.com/positivef/node |
| Pull requests | https://github.com/positivef/node/pulls |
| Actions | https://github.com/positivef/node/actions |
| Projects | https://github.com/positivef/node/projects |
| Security and quality | https://github.com/positivef/node/security |
| Insights | https://github.com/positivef/node/pulse |
| https://github.com/positivef/node/security#security |
| https://github.com/positivef/node/security#reporting-a-bug-in-nodejs |
| HackerOne | https://hackerone.com/nodejs |
| https://github.com/positivef/node/security#nodejs-bug-bounty-program |
| https://github.com/positivef/node/security#reporting-a-bug-in-a-third-party-module |
| https://github.com/positivef/node/security#disclosure-policy |
| https://github.com/positivef/node/security#code-of-conduct-and-vulnerability-reporting-guidelines |
| Code of Conduct | https://github.com/positivef/node/blob/main/CODE_OF_CONDUCT.md |
| https://github.com/positivef/node/security#the-nodejs-threat-model |
| https://github.com/positivef/node/security#experimental-platforms |
| supported platforms | https://github.com/positivef/node/blob/main/BUILDING.md#supported-platforms |
| https://github.com/positivef/node/security#experimental-features-behind-compile-time-flags-experimental-runtime-flags-and-v8-flags |
| https://github.com/positivef/node/security#runtime-gated-experimental-features |
| categories | https://github.com/nodejs/node/blob/main/doc/api/documentation.md?rgh-link-date=2026-08-21T20%3A28%3A33.000Z#stability-index |
| https://github.com/positivef/node/security#compile-time-gated-experimental-features-and-v8-flags |
| https://github.com/positivef/node/security#security-triage-dispositions |
| What constitutes a vulnerability | https://github.com/positivef/node/security#what-constitutes-a-vulnerability |
| https://github.com/positivef/node/security#what-constitutes-a-vulnerability |
| https://github.com/positivef/node/security#denial-of-service-dos-vulnerabilities |
| ECMAScript specification | https://tc39.es/ecma262/ |
| asymmetric resource consumption | https://cwe.mitre.org/data/definitions/405.html |
| https://nodejs.org/api/modules.html#all-together | https://nodejs.org/api/modules.html#all-together |
| https://github.com/positivef/node/security#examples-of-vulnerabilities |
| https://github.com/positivef/node/security#improper-certificate-validation-cwe-295 |
| https://github.com/positivef/node/security#inconsistent-interpretation-of-http-requests-cwe-444 |
| https://github.com/positivef/node/security#missing-cryptographic-step-cwe-325 |
| https://github.com/positivef/node/security#external-control-of-system-or-configuration-setting-cwe-15 |
| https://github.com/positivef/node/security#examples-of-non-vulnerabilities |
| https://github.com/positivef/node/security#defense-in-depth-issues |
| https://github.com/positivef/node/security#malicious-protocol-peers |
| https://github.com/positivef/node/security#unauthorized-or-untrusted-http-proxy-deployments |
| https://github.com/positivef/node/security#malicious-third-party-modules-cwe-1357 |
| https://github.com/positivef/node/security#same-process-self-harm |
| https://github.com/positivef/node/security#prototype-pollution-attacks-cwe-1321 |
| https://github.com/positivef/node/security#uncontrolled-search-path-element-cwe-427 |
| https://github.com/positivef/node/security#external-control-of-system-or-configuration-setting-cwe-15-1 |
| https://github.com/positivef/node/security#uncontrolled-resource-consumption-cwe-400-on-outbound-connections |
| https://github.com/positivef/node/security#vulnerabilities-affecting-software-downloaded-by-corepack |
| https://github.com/positivef/node/security#exposing-application-level-apis-to-untrusted-users-cwe-653 |
| https://github.com/positivef/node/security#build-system-attacks-requiring-control-of-the-build-environment-cwe-78-cwe-114-cwe-276 |
| https://github.com/positivef/node/security#unhandled-error-events-on-eventemitters-cwe-248 |
| https://github.com/positivef/node/security#exceptions-thrown-by-application-callbacks-cwe-248 |
| CVE-2026-21637 | https://www.cve.org/CVERecord?id=CVE-2026-21637 |
| https://github.com/positivef/node/security#permission-model-boundaries---permission |
| Permission Model | https://nodejs.org/api/permissions.html |
| https://github.com/positivef/node/security#quic-and-http3 |
| https://github.com/positivef/node/security#virtual-file-system-nodevfs |
| Virtual File System | https://nodejs.org/api/vfs.html |
| https://github.com/positivef/node/security#v8-sandbox |
| V8 project | https://v8.dev/docs/security-bugs |
| https://github.com/positivef/node/security#crlf-injection-in-writeearlyhints |
| https://github.com/positivef/node/security#receiving-security-updates |
| https://groups.google.com/group/nodejs-sec | https://groups.google.com/group/nodejs-sec |
| https://nodejs.org/en/blog/vulnerability | https://nodejs.org/en/blog/vulnerability |
| https://github.com/positivef/node/security#cve-publication-timeline |
| https://github.com/positivef/node/security#comments-on-this-policy |
| nodejs/security-wg | https://github.com/nodejs/security-wg |
| https://github.com/positivef/node/security#incident-response-plan |
| Security Incident Response Plan | https://github.com/nodejs/security-wg/blob/main/INCIDENT_RESPONSE_PLAN.md |
| https://github.com/positivef/node/security#nodejs-security-team |
| https://github.com/positivef/node/security#nodejs-security-team-membership-policy |
| https://github.com/positivef/node/security#team-responsible-for-triaging-security-reports |
| @mcollina | https://github.com/mcollina |
| @RafaelGSS | https://github.com/RafaelGSS |
| @vdeturckheim | https://github.com/vdeturckheim |
| @BethGriggs | https://github.com/BethGriggs |
| https://github.com/positivef/node/security#team-with-access-to-private-security-reports-against-nodejs |
| TSC voting members | https://github.com/nodejs/node#tsc-voting-members |
| BethGriggs | https://github.com/BethGriggs |
| MylesBorins | https://github.com/MylesBorins |
| bengl | https://github.com/bengl |
| bnoordhuis | https://github.com/bnoordhuis |
| cjihrig | https://github.com/cjihrig |
| joesepi | https://github.com/joesepi |
| juanarbol | https://github.com/juanarbol |
| sxa | https://github.com/sxa |
| ulisesgascon | https://github.com/ulisesgascon |
| vdeturckheim | https://github.com/vdeturckheim |
| member page | https://hackerone.com/organizations/nodejs/settings/users |
| https://github.com/positivef/node/security#team-with-access-to-private-security-patches-to-nodejs |
| @aduh95 | https://github.com/aduh95 |
| @anonrig | https://github.com/anonrig |
| @bengl | https://github.com/bengl |
| @benjamingr | https://github.com/benjamingr |
| @BethGriggs | https://github.com/BethGriggs |
| @bmeck | https://github.com/bmeck |
| @bnoordhuis | https://github.com/bnoordhuis |
| @BridgeAR | https://github.com/BridgeAR |
| @gireeshpunathil | https://github.com/gireeshpunathil |
| @guybedford | https://github.com/guybedford |
| @indutny | https://github.com/indutny |
| @jasnell | https://github.com/jasnell |
| @joaocgreis | https://github.com/joaocgreis |
| @joesepi | https://github.com/joesepi |
| @joyeecheung | https://github.com/joyeecheung |
| @juanarbol | https://github.com/juanarbol |
| @legendecas | https://github.com/legendecas |
| @marco-ippolito | https://github.com/marco-ippolito |
| @mcollina | https://github.com/mcollina |
| @MoLow | https://github.com/MoLow |
| @panva | https://github.com/panva |
| @RafaelGSS | https://github.com/RafaelGSS |
| @richardlau | https://github.com/richardlau |
| @ronag | https://github.com/ronag |
| @ruyadorno | https://github.com/ruyadorno |
| @santigimeno | https://github.com/santigimeno |
| @ShogunPanda | https://github.com/ShogunPanda |
| @sxa | https://github.com/sxa |
| @targos | https://github.com/targos |
| @tniessen | https://github.com/tniessen |
| @UlisesGascon | https://github.com/UlisesGascon |
| @vdeturckheim | https://github.com/vdeturckheim |
|
| https://github.com |
| Terms | https://docs.github.com/site-policy/github-terms/github-terms-of-service |
| Privacy | https://docs.github.com/site-policy/privacy-policies/github-privacy-statement |
| Security | https://github.com/security |
| Status | https://www.githubstatus.com/ |
| Community | https://github.community/ |
| Docs | https://docs.github.com/ |
| Contact | https://support.github.com?tags=dotcom-footer |