{"title":"Node.js advisories","description":"Advisories for the Node.js runtime itself: security releases, TLS and HTTP parsing bugs, and how to roll out fixes.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/","title":"Endor Labs reports OpenClaw apply_patch path traversal, fixed in 2026.2.14","url":"https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/","date":"2026-11-11","summary":"Endor Labs reports a path traversal in OpenClaw apply_patch; the project advisory lists a fix in 2026.2.14, so upgrade openclaw.","tags":["ai-tools","npm","nodejs","ai-tools","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","title":"Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 compromised","url":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","date":"2026-11-11","summary":"Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.","tags":["supply-chain","npm","nodejs","github-actions","crypto","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","title":"\"Node2Shell: an out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) reaches far beyond Node.js\"","url":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","date":"2026-11-11","summary":"CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.","tags":["exploited","nodejs","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/","title":"Node.js October 2026 security release: Brotli RCE now exploited, plus TLS hostname bypasses","url":"https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/","date":"2026-11-11","summary":"Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA's exploited list and three TLS certificate checks.","tags":["exploited","nodejs"]},{"id":"https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/","title":"eMudhra intermediate CA compromise: eight CA keys were guessable in 256 tries, and non-browser clients still need updates","url":"https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/","date":"2026-11-11","summary":"Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.","tags":["ecosystem","endpoint","nodejs","pypi","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","title":"Rejetto HFS CVE-2026-61500: an AI-found bug attacked the day after its write-up","url":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","date":"2026-11-11","summary":"A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.","tags":["exploited","nodejs","npm","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","title":"React maintainers report critical RCE flaw in React Server Components","url":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","date":"2026-11-09","summary":"React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.","tags":["exploited","npm","nodejs","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/","title":"Sonatype reports PolinRider loader in 12 hijacked npm package releases","url":"https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/","date":"2026-11-09","summary":"Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.","tags":["supply-chain","npm","nodejs","open-source","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","title":"Critical Node-RED flaw CVE-2026-58115 exploited in the wild to run code on exposed instances","url":"https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/","date":"2026-11-09","summary":"Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.","tags":["exploited","nodejs","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/","title":"SecurityWeek reports Cisco, WatchGuard patches and unfixed SonicWall GMS flaws","url":"https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/","date":"2026-11-05","summary":"SecurityWeek reports Cisco and WatchGuard patches plus two unfixed SonicWall GMS flaws, so apply vendor fixes and replace end-of-life GMS.","tags":["exploited","network-edge","enterprise","nodejs"]},{"id":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","title":"ARTEX Docker image backdoored, researcher says; CERT-In flags Crafty Falcon","url":"https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/","date":"2026-11-05","summary":"A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.","tags":["supply-chain","ai-tools","open-source","cloud","crypto","php","nodejs","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/pxnpm-npm-malicious-native-launcher-mal-2026-17710/","title":"pxnpm npm package turned into a native-binary launcher that reroutes your registry through the author's host","url":"https://vulnpocalypse.dev/advisories/pxnpm-npm-malicious-native-launcher-mal-2026-17710/","date":"2026-11-05","summary":"pxnpm 7.0.0 to 7.0.2 on npm ship a postinstall launcher that downloads and runs a native binary and forces your registry and proxy through the author's host.","tags":["supply-chain","npm","nodejs","open-source","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/","title":"Impart says its AI harness builds virtual patches outside traffic path","url":"https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/","date":"2026-11-04","summary":"Help Net Security reports Impart claims its new AI harness ships tested virtual patches fast; these are vendor claims, so verify them independently.","tags":["ai-tools","nodejs","php","web","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/glow-labs-reports-ai-coding-agents-install-deprecated-unpatched-mcp-servers/","title":"Glow Labs reports AI coding agents install deprecated, unpatched MCP servers","url":"https://vulnpocalypse.dev/advisories/glow-labs-reports-ai-coding-agents-install-deprecated-unpatched-mcp-servers/","date":"2026-11-03","summary":"Glow Labs reports AI coding agents installing archived MCP servers with unpatched flaws. Audit MCP configs and switch to maintained servers.","tags":["supply-chain","ai-tools","npm","nodejs","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","title":"Hacktober 2026: PHP2Shell, Node.js and LiteLLM fixes, Binance probe","url":"https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/","date":"2026-11-02","summary":"October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.","tags":["ai-tools","php","nodejs","pypi","npm","github-actions","ai-tools","crypto","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/cisa-kev-old-bugs-struts-strapi-onlyoffice-proftpd-bind/","title":"CISA KEV adds five old bugs at once: Struts S2-032, Strapi private-field leak, ONLYOFFICE path traversal, ProFTPD mod_copy and BIND TKEY","url":"https://vulnpocalypse.dev/advisories/cisa-kev-old-bugs-struts-strapi-onlyoffice-proftpd-bind/","date":"2026-11-02","summary":"CISA marked five bugs from 2015 to 2023 as exploited on 8 Oct 2026. Find old Struts 2, Strapi, ONLYOFFICE Docs, ProFTPD and BIND installs and upgrade them.","tags":["exploited","open-source","web","nodejs"]},{"id":"https://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/","title":"npm 12 turns off dependency install scripts by default, and blocks git and remote-URL dependencies unless you allow them","url":"https://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/","date":"2026-11-02","summary":"npm 12 skips dependency install scripts and refuses git and URL dependencies unless allowed. Upgrade, run npm approve-scripts and commit the allowlist.","tags":["supply-chain","npm","nodejs","ci-cd"]}]}