All CosmicBytez Labs articles tagged #Node.js, across news, security advisories, how-to guides, and projects.
NPM 12 will disable dependency install scripts by default, requiring explicit opt-in—a major shift targeting the supply chain attack vector exploited...
sanitize-html versions prior to 2.17.4 allow attacker-controlled content inside a disallowed xmp element to render as live HTML, enabling stored XSS.
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows sandboxed code to obtain the host TypeError constructor via Buffer.__lookupGetter__ abuse,...
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows attackers to bypass the require: false security option using falsy values, circumventing the...
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows sandboxed code to access the host process via the process and inspector/promises builtins,...
A CVSS 10.0 critical vulnerability in vm2 for Node.js allows sandbox code to escape and execute arbitrary OS commands on the host system. Patched in vm2 3.11.4.
Axios versions 1.7.0 through 1.15.x fail to enforce maxContentLength and maxBodyLength when using the fetch adapter, allowing unbounded request and...
Six critical flaws in protobuf.js — the JavaScript/TypeScript Protocol Buffers library — can lead to remote code execution and denial-of-service in...
Build a news aggregation system that fetches from multiple RSS feeds, detects duplicate articles using Jaccard similarity, and generates clean...
Create a lightweight, offline-capable documentation search system using keyword-based scoring instead of ML embeddings. Perfect for air-gapped...