● Node.js Advisory · April 2026

Node.js Security Advisory: April 2026 Windows Batch Injection Triage

Technical triage of Node.js April 2026 emergency update fixing critical command argument injection on Windows systems.

5
CVEs Patched
1
Critical Remote Code Execution
8.8
CVSS BatBadBut
Critical
Windows Fleet Urgency

Triagem Executiva e Veredito de Risco

Node.js issued emergency updates for CVE-2024-27980 (BatBadBut). On Windows, calling child_process.spawn() with .bat or .cmd files implicitly invoked cmd.exe without escaping quotes, allowing arbitrary code execution.

Matriz Curada de Triagem de Vulnerabilidades

Identificador CVE Subsistema / Componente Impacto CVSS Exploração Ativa?
CVE-2024-27980child_process SubsystemWindows Command Injection8.8 HighYES (In-The-Wild)
CVE-2024-27981OpenSSL QuicMemory Leak6.1 MediumNo
CVE-2024-27982dns.lookupDNS Rebinding5.3 MediumNo
ANÁLISE DE CÓDIGO EM DESTAQUE

Deep Dive: Node.js Windows Batch Argument Injection (BatBadBut) Teardown →

Examine the JavaScript spawn wrapper in lib/child_process.js escaping batch arguments before passing them to CreateProcessW.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →