This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · Node.js

Node.js Vulnerabilities

The latest security flaws in Node.js, which ones attackers are using, and whether your Node.js version is affected or out of support.

New flaws, 30 days
30
Critical, 8 weeks
1
On CISA's exploited list
1
Latest exploited
27 Oct 2026

Run node -v on the server or in the container.

Node.js Security in Short

Node.js publishes security releases for all supported lines at once, usually announced a week ahead. Only even-numbered lines get long-term support, for about 30 months; odd-numbered lines are short-lived. Flaws in Node.js itself are fewer than in npm packages, but they affect every app on that runtime. Node2Shell was one.

How to Keep Node.js Patched

  • Stay on an LTS line and move off it before its end-of-life date.
  • Update through your version manager (nvm, fnm, Volta), the NodeSource repository or your base Docker image, then restart the app.
  • Rebuild containers. A Docker image keeps the Node.js it was built with until you rebuild it.
  • Run npm audit too: most risk is in your dependencies, which this page doesn't cover.

The Past Eight Weeks

Any Score 7+ 8+ 9+

1 flaw scored 9+, newest first.

22 Oct 2026 Memory corruption A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 throug… CVE-2026-111497 9.8 Exploited

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Patch now · NVD Record

On Hacker News

Node.js Brotli RCE (CVE-2026-111497)Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) 3 commentsNode2Shell: Node.js Brotli vulnerability allows remote code execution 1 comment

Being Exploited

Node.js flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 1 on the KEV page.

Patch now

Node.js

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on al…

Score 9.8 / 10 · Being exploited · Fixed in 1.0.10, 1.1.1, 1.2.1, 22.23.4

CVE-2026-111497

On HN

Read: Node2Shell ›

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions