https://vulnpocalypse.dev/feeds/Advisories for the Node.js runtime itself: security releases, TLS and HTTP parsing bugs, and how to roll out fixes.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/Wed, 11 Nov 2026 12:00:00 +0000Endor Labs reports a path traversal in OpenClaw apply_patch; the project advisory lists a fix in 2026.2.14, so upgrade openclaw.ai-toolsnpmnodejsai-toolsopen-sourcehttps://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/Wed, 11 Nov 2026 12:00:00 +0000Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.supply-chainnpmnodejsgithub-actionscryptoopen-sourcehttps://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/Wed, 11 Nov 2026 12:00:00 +0000CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.exploitednodejsopen-sourcehttps://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/https://vulnpocalypse.dev/advisories/nodejs-october-2026-security-release/Wed, 11 Nov 2026 12:00:00 +0000Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA's exploited list and three TLS certificate checks.exploitednodejshttps://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/Wed, 11 Nov 2026 12:00:00 +0000Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.ecosystemendpointnodejspypiopen-sourcehttps://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/Wed, 11 Nov 2026 12:00:00 +0000A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.exploitednodejsnpmopen-sourcehttps://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/Mon, 09 Nov 2026 12:00:00 +0000React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.exploitednpmnodejswebopen-sourcehttps://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/Mon, 09 Nov 2026 12:00:00 +0000Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.supply-chainnpmnodejsopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/https://vulnpocalypse.dev/advisories/node-red-cve-2026-58115/Mon, 09 Nov 2026 12:00:00 +0000Attackers are exploiting a CVSS 10 missing-authentication flaw in Node-RED to create malicious flows and run code on instances left without adminAuth.exploitednodejsnetwork-edgehttps://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/https://vulnpocalypse.dev/advisories/securityweek-reports-cisco-watchguard-patches-and-unfixed-sonicwall-gms-flaws/Thu, 05 Nov 2026 12:00:00 +0000SecurityWeek reports Cisco and WatchGuard patches plus two unfixed SonicWall GMS flaws, so apply vendor fixes and replace end-of-life GMS.exploitednetwork-edgeenterprisenodejshttps://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/Thu, 05 Nov 2026 12:00:00 +0000A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.supply-chainai-toolsopen-sourcecloudcryptophpnodejsci-cdhttps://vulnpocalypse.dev/advisories/pxnpm-npm-malicious-native-launcher-mal-2026-17710/https://vulnpocalypse.dev/advisories/pxnpm-npm-malicious-native-launcher-mal-2026-17710/Thu, 05 Nov 2026 12:00:00 +0000pxnpm 7.0.0 to 7.0.2 on npm ship a postinstall launcher that downloads and runs a native binary and forces your registry and proxy through the author's host.supply-chainnpmnodejsopen-sourceendpointhttps://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/https://vulnpocalypse.dev/advisories/impart-says-its-ai-harness-builds-virtual-patches-outside-traffic-path/Wed, 04 Nov 2026 12:00:00 +0000Help Net Security reports Impart claims its new AI harness ships tested virtual patches fast; these are vendor claims, so verify them independently.ai-toolsnodejsphpwebai-toolshttps://vulnpocalypse.dev/advisories/glow-labs-reports-ai-coding-agents-install-deprecated-unpatched-mcp-servers/https://vulnpocalypse.dev/advisories/glow-labs-reports-ai-coding-agents-install-deprecated-unpatched-mcp-servers/Tue, 03 Nov 2026 12:00:00 +0000Glow Labs reports AI coding agents installing archived MCP servers with unpatched flaws. Audit MCP configs and switch to maintained servers.supply-chainai-toolsnpmnodejsendpointopen-sourcehttps://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/https://vulnpocalypse.dev/advisories/hacktober-2026-php2shell-nodejs-and-litellm-fixes-binance-probe/Mon, 02 Nov 2026 12:00:00 +0000October 2026 brought unrelated incidents, including PHP2Shell, Node.js patches and a malicious LiteLLM 1.107.0; update runtimes and review credentials.ai-toolsphpnodejspypinpmgithub-actionsai-toolscryptocloudhttps://vulnpocalypse.dev/advisories/cisa-kev-old-bugs-struts-strapi-onlyoffice-proftpd-bind/https://vulnpocalypse.dev/advisories/cisa-kev-old-bugs-struts-strapi-onlyoffice-proftpd-bind/Mon, 02 Nov 2026 12:00:00 +0000CISA marked five bugs from 2015 to 2023 as exploited on 8 Oct 2026. Find old Struts 2, Strapi, ONLYOFFICE Docs, ProFTPD and BIND installs and upgrade them.exploitedopen-sourcewebnodejshttps://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/https://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/Mon, 02 Nov 2026 12:00:00 +0000npm 12 skips dependency install scripts and refuses git and URL dependencies unless allowed. Upgrade, run npm approve-scripts and commit the allowlist.supply-chainnpmnodejsci-cd