nodejs on Raúl Pastorhttps://pixelotes.com/tags/nodejs/Recent content in nodejs on Raúl PastorHugoenWed, 28 Oct 2026 08:45:00 +0100Node.js October 2026 security release: Brotli RCE and certificate checks fooled by odd IPshttps://pixelotes.com/blog/nodejs-october-2026/Mon, 26 Oct 2026 18:20:00 +0100https://pixelotes.com/blog/nodejs-october-2026/<h2 id="in-one-paragraph">In one paragraph</h2> <p>On 21 October 2026 Node.js shipped <strong>22.23.4, 24.22.1 and 26.12.1</strong>, fixing ten vulnerabilities. The headline is <strong>CVE-2026-111497</strong>, a memory corruption bug in the bundled Brotli decompressor that researchers nicknamed <strong>Node2Shell</strong>. Any app that decompresses Brotli data from someone it doesn&rsquo;t trust is exposed, and two very common paths do it by default. CISA added it to the KEV catalog on 27 October. Node.js 20 and every other end-of-life line get no fix.</p>