16 Node.js Fixes in November: For Those Running HTTPS/HTTP/2 Directly in Node

Node.js released security updates (22.23.5 / 24.22.3 / 26.13.1) for its three active branches: 22.x, 24.x, and 26.x. There ...

Microsoft and others scramble to patch Node.js flaw which could be the next PHP-level issue

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.
The Hacker News

Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.

GitHub宣布收购npm，微软或成最大赢家，开源界野蛮竞争影响1200万开发者

GitHub官方于 3 月 16 日正式宣布已经签署了收购npm的协议，未来将帮助npm满足快速增长的JavaScript社区的需求。众所周知，GitHub已经成为微软的子公司，微软此举或将重新获取开源社区及Web端开发的领先地位。 npm完全用JavaScript写成，最初由艾萨克·施吕特（Isaac Z. Schlueter）开发。艾萨克表示自己意识到“模块管理很糟糕”的问题，并看到了PHP的 ...
Help Net Security

Node.js 26 ships with Temporal API enabled by default

Developers managing JavaScript runtimes have a new major version to evaluate. Node.js 26.0.0 brings the long-awaited Temporal API to the platform alongside an updated V8 engine, a refreshed HTTP ...