Node.js project security releases (nodejs.org vulnerability blog)

nodejs-security-releases · A · candidate

https://nodejs.org/en/blog/vulnerability/

vendor-psirtlang: enfetch failures: 0quiet periods: 0last fetch: 2026-10-24

Added 2026-10-24 (2026-10-24T0255Z-intel): S1/S4 candidate: project primary for a runtime under a very large share of government web back ends; the feed works with `fetch_source.py feed` (dated items back to 2026-03-24) and the 2026-10-21 release carried CVE-2026-111497 (Node2Shell), which no source in the pipeline surfaced until NCSC-NL relayed it two days later.

Cited in 1 entry

Citation cadence

Citation days per ISO week (1 weeks of coverage span, total 1).

CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24