criticalVulnerability
Node.js Bundled Brotli Decoder Flaw Patched Across Three Supported Release Lines
Critical remote code execution vulnerability addressed in Node.js 22.x, 24.x, and 26.x security updates
Cyber.TechVoid1 min read
Key Takeaways
- Node.js released security updates on October 21, 2026, fixing 10 vulnerabilities across three supported release lines.
- A critical remote code execution bug in the bundled Brotli decompression code is the most serious flaw.
- All three supported release lines (22.x, 24.x, and 26.x) are affected.
Related Security News
criticalVulnerability
PHP2Shell: Two Critical Remote Code Execution Flaws Rated CVSS 9.2 Trigger Emergency Security Release
The PHP security team has announced an out-of-cycle security release scheduled for 14:00 UTC on October 21, 2026, to address two critical remote code execution vulnerabilities. Rated 9.2 on the CVSS v4.0 scale by watchTowr researchers, the flaws affect all four currently supported PHP branches. No exploitation has been reported publicly at the time of the alert.
The Hacker News1 min read
