The Hacker News

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...
Cybernews

PHP was just the beginning: Node.js unveils dangerous flaws threatening millions of sites

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...
cyberkendra.com

Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Node.js fixes its own and inherited security vulnerabilities

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra ...