● Node.js Advisory · April 2026

Node.js Security Advisory: April 2026 Windows Batch Injection Triage

Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.

5
CVEs Patched
1
Critical Remote Code Execution
8.8
CVSS BatBadBut
Critical
Windows Fleet Urgency

보안 릴리스 분석 및 위험성 평가

Node.js issued emergency updates for CVE-2024-27980 (BatBadBut). On Windows, calling child_process.spawn() with .bat or .cmd files implicitly invoked cmd.exe without escaping quotes, allowing arbitrary code execution.

핵심 취약점 트리아지 매트릭스

CVE 식별자 서브시스템 / 구성 요소 영향 CVSS 실제 악용 여부?
CVE-2024-27980child_process SubsystemWindows Command Injection8.8 HighYES (In-The-Wild)
CVE-2024-27981OpenSSL QuicMemory Leak6.1 MediumNo
CVE-2024-27982dns.lookupDNS Rebinding5.3 MediumNo
주목할 코드 분석

Deep Dive: Node.js Windows Batch Argument Injection (BatBadBut) Teardown →

Examine the JavaScript spawn wrapper in lib/child_process.js escaping batch arguments before passing them to CreateProcessW.

← 전체 보안 디렉터리 보기 모든 플랫폼 보안 업데이트 →