Node.js fixed 16 vulnerabilities across three supported lines, including HTTP/2 server crashes and HTTPS memory disclosure.

The Node.js Project shipped coordinated security releases on November 11, 2026. They cover the 22.x, 24.x and 26.x lines in v22.23.5, v24.22.3 and v26.13.1.

Do you have any servers or tools running on Node.js? A security update has been released for Node.js versions 22, 24, and 26, which includes 7 HIGH severity issues. The most serious one is that, ...

Node.js patched 16 flaws in versions 22.x, 24.x and 26.x. Some can leak TLS private keys or crash servers. Here is what to ...

CalderHayes9638 proposes a queryable event ledger and an independent monitor to detect silent import failures in Node.js SaaS marketplaces. The design protects durable watermarks, keeps alert delivery ...

Node.js 26.13.1, 24.22.3 and 22.23.5 fix seven High-rated HTTP/2 and TLS flaws that unauthenticated clients can trigger.

This document provides Node/TypeScript-specific best practices and examples for implementing MCP servers using the MCP TypeScript SDK. It covers project structure ...

Inspect a local Electron/JavaScript directory or ASAR without executing its code. analyze_javascript_application and the CLI routes below return an Evidence record with the application graph, static ...

October’s cybersecurity disclosures spanned cryptocurrency exchanges, web runtimes, AI platforms, software repositories, government records, and supermarkets.

New research from cloud security firm Wiz reveals that 91% of cloud environments contain resources vulnerable to CVE-2026-111497, a dangerous flaw in Google’s widely-used Brotli compression technology ...

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.