What happened: Node shipped 10 security fixes today plus the eMudhra CA block. • A flaw in Node's Brotli compression decoder lets an attacker run code remotely. • 3 bugs let attackers bypass HTTPS certificate checks (including using Unicode digits to fake IP addresses). • Single-executable Node apps were saving their random seed at build time, so every run generated the exact same "random" UUIDs. • Node hardcodes its own list of trusted CAs inside the binary, so updating Linux does not stop Node from trusting the leaked eMudhra keys.
Real-world impact: Almost every modern web backend, API server, and CLI tool runs on Node. Until you update the Node binary itself, your backend can be tricked into trusting fake HTTPS servers (via eMudhra) or compromised by a crafted compressed request.
10/21/2026 (Wed) 19:33
No.74135
del
