Joyent's vulnerability footprint centers on a focused but strategically important set of infrastructure and runtime products, most prominently SmartOS, Node.js, and associated libraries, that sit deep in cloud and application deployment chains. The company's disclosures cluster around memory-safety and input-handling issues—classical buffer overflows, improper input validation, path traversal, integer overflows, and out-of-bounds writes—that reflect the complexity of systems-level software and protocol parsing. While the vendor's product count is narrow, its prominence in the landscape stems from the wide adoption of Node.js across web applications and services, which distributes exposure beyond Joyent's direct control. Defenders should monitor this vendor's advisories for both direct infrastructure deployments and the downstream impact on Node.js-dependent applications; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Joyent over time
Signals from CVEs in this vendor scope (20 CVEs).
20 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-0217HIGH The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos befor | Jun 12, 2012 | 7.2 | 65 | NO | YES |
CVE-2014-7192HIGH Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rational Application Developer and other products, allows remot | Dec 11, 2014 | 10.0 | 41 | NO | YES |
CVE-2020-27678CRITICAL An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_u | Oct 26, 2020 | 9.8 | 30 | NO | NO |
CVE-2016-8733HIGH An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ | Dec 14, 2016 | 8.8 | 28 | NO | NO |
CVE-2020-7712HIGH This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function. | Aug 30, 2020 | 7.2 | 25 | NO | NO |
CVE-2014-6394HIGH visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricte | Oct 8, 2014 | 7.5 | 25 | NO | NO |
CVE-2018-3737HIGH sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. | Jun 7, 2018 | 7.5 | 24 | NO | NO |
CVE-2017-10940HIGH This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to [email protected] | Oct 31, 2017 | 8.8 | 24 | NO | NO |
CVE-2016-9032HIGH An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_A | Dec 14, 2016 | 7.0 | 24 | NO | NO |
CVE-2018-1171HIGH This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the | Mar 19, 2018 | 7.0 | 23 | NO | NO |
Signals from CVEs in this vendor scope (20 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Joyent.
Media articles that mention a CVE ID that affects a product developed by Joyent — matched by CVE ID, not by vendor name.