Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...

Node.js is moving to one major release a year beginning with version 27, ending the distinction that previously reserved long-term support for even-numbered releases.

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

ELLIO logs the first in-the-wild Node2Shell (CVE-2026-111497) attack — a 23 MB Brotli payload hitting stock Node.js. Patch ...

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...

The Node.js Project released security updates on October 21, 2026, addressing ten vulnerabilities across its 26.x, 24.x, and ...

Node.js patched node2shell, CVE-2026-111497, after a Brotli decoder flaw that can trigger crashes, memory leaks, or remote ...

CVE-2026-111497 in Google’s Brotli decoder can corrupt memory across Node.js, Bun, Python and Envoy, with code execution ...

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has ...

OpenAI's Codex security researchers uncovered Node2Shell (CVE-2026-111497), a critical flaw in the Brotli compression code ...

A screen displaying computer code. Image for illustrative purposes. Yonhap News Agency [Financial News] A vulnerability that ...

In October, a critical vulnerability in PHP and multiple vulnerabilities in Node.js were announced around the same time.