Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one ...

On October 21, 2026, Node.js released v22.23.4, v24.22.1, and v26.12.1, which fix 10 vulnerabilities. The most severe, ...

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Node2Shell exploits a high-severity memory flaw in Node.js’s Brotli decoder to execute attacker-controlled code.

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

For Cloudflare, the Deno buy is an acquihire for Dahl and 12 of his Deno colleagues, who will work to build out Cloudflare’s ...

OpenAI posted a message on X. They stated that during testing using their own AI, they discovered a remotely exploitable flaw ...

OpenAI found a remote code execution flaw in the Brotli compression library, prompting Node.js, Bun, Envoy and PyPI maintainers to ship patches.