Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.

Node.js has shipped security updates to fix a high-severity vulnerability that could let an attacker run arbitrary code on a ...

The Node.js Project released security updates on October 21, 2026, addressing ten vulnerabilities across its 26.x, 24.x, and ...

Node.js patched node2shell, CVE-2026-111497, after a Brotli decoder flaw that can trigger crashes, memory leaks, or remote ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix TLS verification bypasses, a Brotli decoder bug and a repeated-random-value issue in ...

Node2Shell exploits a high-severity memory flaw in Node.js’s Brotli decoder to execute attacker-controlled code.

You might think things have calmed down a bit as responses to the critical PHP vulnerability have progressed.However, website ...

A security update released October 21 fixes ten vulnerabilities across Node.js 26.x, 24.x, and 22.x, including an out-of-bounds write in the Brotli decompression library.

In October 2026, a critical vulnerability related to Node.js became a hot topic under the names "HTTP2Shell" and "Node2Shell".The identification number is "CVE-2026-111497".In short, the issue lies in ...

For Cloudflare, the Deno buy is an acquihire for Dahl and 12 of his Deno colleagues, who will work to build out Cloudflare’s ...