Node.js 26.x, 24.x and 22.x get High-rated fixes on or shortly after November 11; CVE details stay private until release.
Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.
Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.
Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled data.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results