● Node.js Advisory · April 2026

Node.js Security Advisory: April 2026 Windows Batch Injection Triage

Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.

5
CVEs Patched
1
Critical Remote Code Execution
8.8
CVSS BatBadBut
Critical
Windows Fleet Urgency

セキュリティトリアージとリスク評価

Node.js issued emergency updates for CVE-2024-27980 (BatBadBut). On Windows, calling child_process.spawn() with .bat or .cmd files implicitly invoked cmd.exe without escaping quotes, allowing arbitrary code execution.

優先脆弱性トリアージマトリックス

CVE識別番号 対象サブシステム / コンポーネント 影響範囲 CVSS ゼロデイ悪用確認？
CVE-2024-27980child_process SubsystemWindows Command Injection8.8 HighYES (In-The-Wild)
CVE-2024-27981OpenSSL QuicMemory Leak6.1 MediumNo
CVE-2024-27982dns.lookupDNS Rebinding5.3 MediumNo
注目ソースコード分析

Deep Dive: Node.js Windows Batch Argument Injection (BatBadBut) Teardown →

Examine the JavaScript spawn wrapper in lib/child_process.js escaping batch arguments before passing them to CreateProcessW.

← セキュリティディレクトリ一覧 すべてのセキュリティ更新情報 →