Serial number: AV26-1156 Date: November 12, 2026 As of November 11, 2026, Nodejs is affected by a vulnerability in the following product: node Prior to v24.22.3 Prior to v26.13.1 Prior to v22.23.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Wednesday, November 11, 2026 Security Releases Node.js
Read the full article at Canadian Centre for Cyber Security →
Source attribution: headline and facts are from Canadian Centre for Cyber Security (cyber.gc.ca). Summary method: excerpt of the source description. See our source attribution policy.
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's built-in HTTP/2 support on the 24.x and 26.x release lines. A second…
Posted by Antoine du Hamel on Nov 11 Releases are out, more info at https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
Posted by Antoine du Hamel on Nov 04 We will release new versions of Node.js 22, 24, and 26 release lines on or shortly after 2026-11-11 in order to address security…
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
Posted by Michael Orlitzky on Oct 24 Only those dumb enough to bundle or statically link their dependencies. The bare minimum in terms of software engineering would…
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli…