nodejs
Node.js October 2026 security release: a Brotli RCE and three ways to fool TLS hostname checks
Node.js shipped security releases across all three supported lines on 2026-10-21, fixing 10 CVEs. The headline is an out-of-bounds write in the bundled Brotli decoder that can end in remote code execution, plus three high-severity bypasses in TLS hostname verification that share a single root cause.