A critical flaw has been discovered in 'Node.js,' which is widely used behind the scenes of web services and applications. It is called 'Node2Shell' and is identified as CVE-2026-111497.Node.js ...

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.

Node.js 26.12.1, 24.22.1 and 22.23.4 fix TLS verification bypasses, a Brotli decoder bug and a repeated-random-value issue in snapshots. Here is what to check after updating, from TLS connections to ...

Node2Shell exploits a high-severity memory flaw in Node.js’s Brotli decoder to execute attacker-controlled code.

Hello, kazu here.You've built an app with the help of AI. Have you checked the updates for the Node.js or Bun environments that run that code?In this article, I will explain what was discovered ...

Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.

Node.js patched 10 vulnerabilities across versions 26.x, 24.x, and 22.x, including four high-severity flaws affecting DNS, TLS, and Brotli decompression.

AWS recently introduced Lambda Web Functions, allowing developers to run Node.js web applications using frameworks such as Express and Hono directly on Lambda, with support for concurrent requests and ...

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.

Push from GitHub, or straight from Claude Code. HCode builds the app, runs it in South Africa and keeps its database right ...