// live feed What's getting pwned right now Ongoing security incidents, newest first: CVEs, what's affected, which versions fix it, and the advisories and posts behind each one. live 35 critical 15 not fully patched 18 ## 191 incidents in the last year through Oct 22, 2026 crit 4 · high 3 · med 2 · low 1 · upd ½ severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½ less more Get an…
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version: 22.23.4 and…
The Node.js Project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 26.x, 24.x, and 22.x release lines. The updates fix a critical Brotli decoder flaw that allows remote code execution , as well as weaknesses in DNS resolution, TLS certificate validation, cryptographic randomness, and filesystem permissions. The release addresses four high-severity, three…
Node.js has released security updates for its 26.x, 24.x, and 22.x branches to address ten vulnerabilities, including four high-severity flaws affecting DNS lookups, TLS certificate checks, and Brotli decompression. The supplied release details identify 26.12.1, 24.22.1, and 22.23.4 as the patched versions. The most serious potential outcome is remote code execution through the Brotli decoder.…
The Node.js Project Security releases available Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues. This security release includes the following dependency updates to address public vulnerabilities: c-ares on 26.x, 24.x, 22.x ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x OpenSSL on 24.x, 22.x SQLite on 22.x Undici on 26.x, 24.x,…