Nodejs
10 articles
Attackers are deploying bots through Node-RED editors with no login (CVE-2026-58115, Siemens IoT2050)
How to fix CVE-2026-58115: upgrade SIMATIC IoT2050 Advanced to Industrial OS V4.3.4.1 or later. Anywhere else, turn on adminAuth in Node-RED's settings.js: one POST /flows to an editor with no login is enough to run a Linux bot, and VulnCheck saw it in the wild on October 30.
HOL GuardThe Brotli decoder bug is now on CISA's exploited list after a first attack on Node.js 24.22.0 (CVE-2026-111497)
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and patch libbrotli to 1.0.10, 1.1.1 or 1.2.1, then restart and rebuild. CISA added the Brotli bug to KEV on Oct 27, due Nov 10, a day after the first exploit attempt hit Node.js 24.22.0.
HOL GuardOne gzipped POST crashes Express via body-parser CVE-2026-111181. Upgrade to 1.20.9 or 2.4.0
How to fix CVE-2026-111181: upgrade body-parser to 1.20.9 or 2.4.0. Trailing bytes after a compressed request body crash the Node process before routing runs.
HOL GuardNode.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.
HOL GuardeMudhra CA keys leaked: forged HTTPS certs still pass in old Go, Python, Node.js and Java (CVE-2026-111943)
How to fix CVE-2026-111943: upgrade Go to 1.27.3 or 1.26.10 and rebuild, then update certifi to 2026.10.19, Node.js to 22.23.4, 24.22.1 or 26.12.1, and your ca-certificates. Eight eMudhra intermediate CA keys can be recovered from the public certificates, so non-browser clients will accept forged HTTPS for any site.
HOL GuardCVE-2026-87776: Express compression leaks native memory until the process dies
How to fix CVE-2026-87776: upgrade compression to 1.8.2
HOL GuardCVE-2026-75021: fastify-cli debug-host bind can expose Inspector RCE
How to fix CVE-2026-75021: upgrade fastify-cli to 8.0.1
HOL GuardCVE-2026-85024: undici WebSocket deflate bug can crash the Node process
How to fix CVE-2026-85024: upgrade undici to 8.10.2 (or 7.29.1 / 6.28.1 on older trains)
HOL GuardCVE-2026-76169 lets malformed URLs skip Fastify not-found auth
How to fix CVE-2026-76169: upgrade fastify to 5.12.2
HOL GuardCVE-2026-85184 lets absolute-form requests skip Fastify middie auth
How to fix CVE-2026-85184: upgrade @fastify/middie to 9.3.4
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.