Node.js fixes ten flaws, including one that can run attacker code through compressed data
Node.js released fixes on 21 October for ten security flaws across versions 22, 24 and 26. The most serious (CVE-2026-111497) sits in the built-in Brotli decompressor: an app that unpacks Brotli data from an attacker, in an upload or in a response from another server, can crash, leak memory or run the attacker's code. Researchers have shown it working on unpatched versions.
Deception angle
Node.js runs inside containers, build tools and appliances you may not think of, so finding every copy is the hard part. While that work goes on, a decoy in the segments where these services run tells you if anyone is already exploring from one of them, and the leaked-memory risk is a good reason to plant decoy credentials there too.
Source: Node.js
Read about Kandaro Deception, or browse more security news.