News Vulnerabilities & Zero-Days
Node.js patches 10 flaws, including a Brotli bug that permits remote code execution and TLS certificate bypasses
Node.js released 26.12.1, 24.22.1 and 22.23.4 on 21 October 2026 to fix 10 vulnerabilities, four rated high, including a Brotli decoder flaw that permits remote code execution and two TLS hostname verification bypasses. The update also blocks the compromised eMudhra certificates.
Jay B.