#Node.js
All CosmicBytez Labs articles tagged #Node.js, across news, security advisories, how-to guides, and projects.
- News
Brotli Decoder Flaw (CVE-2026-111497) Behind Node.js RCE Also Hits Bun, Python, Envoy and Istio
A memory-corruption bug in Google's Brotli decoder lets crafted data corrupt memory in Node.js, Bun, Python, Envoy and more. Update and restart.
- News
Node2Shell: Imperva Demonstrates RCE on Official Node.js Build Using Crafted Brotli Data
CVE-2026-111497, a Brotli decoder out-of-bounds write bundled in Node.js 22, 24 and 26, enabled code execution in Imperva's Node2Shell demo. Patch now.
- News
Node.js Brotli Decoder Bug (CVE-2026-111497) Could Allow Remote Code Execution in All Supported Versions
Node.js 22.x, 24.x and 26.x security releases fix 10 flaws, including a Brotli out-of-bounds write that can lead to remote code execution.
- News
MALFEX npm Package 'imgdecode' Hides Shellcode Loader Inside a Windows Native Addon
MALFEX's latest npm package moves its loader into a compiled Windows DLL, evading scanners that only inspect JavaScript source.
- News
Rejetto HFS Servers Now Actively Scanned for Critical RCE Flaw
Attackers are actively scanning for CVE-2026-61500, a weak signing-key flaw in Rejetto HFS enabling session forgery and remote code execution.
- Security
vm2 NodeVM External-Module Resolver Authorization Bypass (CVE-2026-100721)
vm2 before 3.12.2 lets sandboxed guest code escape via a prefix-match flaw in the NodeVM external-module resolver, enabling host code execution.
- Security
CVE-2026-82854: Nodemailer SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 lets attackers inject SMTP commands via unsanitized envelope.size, silently adding recipients to outbound mail.
- Security
CVE-2026-78207: Critical Prototype Pollution in exceljs-hardened Before v5.0.0
A CVSS 9.4 prototype pollution vulnerability in exceljs-hardened's deepMerge helper allows attackers to corrupt Object.prototype via crafted XLSX files.
- News
Critical isolated-vm Vulnerability Leads to RCE on Host
A TOCTOU type confusion bug in isolated-vm lets sandboxed JavaScript escape the V8 isolate and execute arbitrary code on the host. Update to 6.2.0 or 7.0.1.
- News
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
A critical unpatched flaw in isolated-vm allows sandboxed JavaScript code to escape its isolated environment and achieve host-level remote code execution.
- Security
Critical Deserialization Flaw in Seroval JS Library (CVE-2026-59940)
Seroval < 1.5.3 allows attacker-controlled JSON Promise nodes to bypass reference validation in fromJSON(), enabling object forgery. CVSS 9.8.
- Security
vm2 Sandbox Escape via Error.cause Host Object Leak (CVE-2026-47686)
Critical vm2 sandbox escape allows Node.js sandbox code to access the host process object via unsanitized Error.cause, enabling full RCE.
- Security
vm2 Prototype Chain Escape via Function.prototype.call Stacking (CVE-2026-47698)
Critical vm2 flaw lets sandboxed code sever host intrinsic prototype chains using stacked Function.prototype.call, escaping the sandbox entirely.
- Security
CVE-2026-73041: SiYuan XSS via PDF Annotation Fields Grants Full Node.js Access
Critical CVSS 9.0 XSS in SiYuan's PDF annotation renderer allows script injection with full Node.js access on affected versions before v3.7.4.
- News
Amazon Links Debug, Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon security researchers have attributed the compromise of widely used NPM packages including debug and chalk to a North Korea-linked threat group, in...
- Security
CVE-2026-14198: Fastify Middie Middleware Path Bypass (CVSS 9.1)
Critical path bypass vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 allows attackers to evade middleware protection by exploiting a %2F...
- Security
CVE-2026-12866: expr-eval npm Package Enables Arbitrary Code Execution via toJSFunction()
All versions of the expr-eval JavaScript package are vulnerable to remote code execution through the toJSFunction() API. Crafted expressions escape the...
- News
NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks
NPM 12 will disable dependency install scripts by default, requiring explicit opt-in—a major shift targeting the supply chain attack vector exploited...
- Security
CVE-2026-44990: sanitize-html XMP Element XSS Bypass (CVSS 9.3)
sanitize-html versions prior to 2.17.4 allow attacker-controlled content inside a disallowed xmp element to render as live HTML, enabling stored XSS.
- Security
CVE-2026-47131: vm2 Sandbox Escape via Buffer Prototype Hijack (CVSS 10.0)
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows sandboxed code to obtain the host TypeError constructor via Buffer.__lookupGetter__ abuse,...
- Security
CVE-2026-47137: vm2 Sandbox Escape via Strict Equality require Bypass (CVSS 10.0)
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows attackers to bypass the require: false security option using falsy values, circumventing the...
- Security
CVE-2026-47140: vm2 Sandbox Escape via Incomplete Builtin Denylist (CVSS 10.0)
A CVSS 10.0 critical sandbox escape in vm2 for Node.js allows sandboxed code to access the host process via the process and inspector/promises builtins,...
- Security
CVE-2026-47208: vm2 General Sandbox Breakout — Arbitrary Host Execution (CVSS 10.0)
A CVSS 10.0 critical vulnerability in vm2 for Node.js allows sandbox code to escape and execute arbitrary OS commands on the host system. Patched in vm2 3.11.4.
- Security
CVE-2026-44488: Axios Fetch Adapter Ignores Configured Request and Response Size Limits
Axios versions 1.7.0 through 1.15.x fail to enforce maxContentLength and maxBodyLength when using the fetch adapter, allowing unbounded request and...
- News
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS
Six critical flaws in protobuf.js — the JavaScript/TypeScript Protocol Buffers library — can lead to remote code execution and denial-of-service in...
- HOWTO
Automated News Aggregation with Deduplication Algorithms
Build a news aggregation system that fetches from multiple RSS feeds, detects duplicate articles using Jaccard similarity, and generates clean...
- Project
Building a RAG System Without ML Embeddings
Create a lightweight, offline-capable documentation search system using keyword-based scoring instead of ML embeddings. Perfect for air-gapped...