● Node.js Advisory · April 2026

Node.js Security Advisory: April 2026 Windows Batch Injection Triage

Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.

5
CVEs Patched
1
Critical Remote Code Execution
8.8
CVSS BatBadBut
Critical
Windows Fleet Urgency

सुरक्षा समीक्षा और जोखिम विश्लेषण

Node.js issued emergency updates for CVE-2024-27980 (BatBadBut). On Windows, calling child_process.spawn() with .bat or .cmd files implicitly invoked cmd.exe without escaping quotes, allowing arbitrary code execution.

संवेदनशील कमियों की विस्तृत तालिका

CVE पहचानकर्ता सबसिस्टम / घटक प्रभाव CVSS सक्रिय हमला?
CVE-2024-27980child_process SubsystemWindows Command Injection8.8 HighYES (In-The-Wild)
CVE-2024-27981OpenSSL QuicMemory Leak6.1 MediumNo
CVE-2024-27982dns.lookupDNS Rebinding5.3 MediumNo
सोर्स कोड का गहन विश्लेषण

Deep Dive: Node.js Windows Batch Argument Injection (BatBadBut) Teardown →

Examine the JavaScript spawn wrapper in lib/child_process.js escaping batch arguments before passing them to CreateProcessW.

← सम्पूर्ण सुरक्षा निर्देशिका सभी सुरक्षा पैच अपडेट्स →