資安署指出，Node.js廣泛應用於現代網頁前端工具鏈、後端微服務架構與各類API伺服器。這次Node.js共修補10項資安漏洞，其中4項屬高風險等級。最受矚目的CVE-2026-111497漏洞存在於Brotli解碼器中，因邊界外寫入（Out-of-bounds Write）缺陷，攻擊者可藉由惡意構造的請求觸發記憶體損壞，進而達成遠端執行程式碼（RCE）。
Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.
Brotli是常見的網頁資料壓縮格式，Node.js內建的解壓縮功能存在CVE-2026-111497漏洞。程式在解壓縮資料時，可能將內容寫入超出預定範圍的記憶體，造成記憶體資料遭破壞，嚴重時可能讓攻擊者遠端執行程式碼。該漏洞影響三個版本分支，但官方尚未詳細說明攻擊所需條件，也未公布遭實際利用的案例。
New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra ...
Learn how ESLint can catch conflicts with CSP, Trusted Types, and Permissions Policy before they reach the browser.
With just under 59% of last week's vote, Waukesha West's Kat Nelson won the Journal Sentinel high school athlete of the week ...
Track upcoming Nintendo Switch 2 games in 2026 with a scraper-and-alert bot. 12 steps, code included, from scraping to ...
When I had a local AI fix my Web game, it ended up becoming unlaunchable. In the 6th installment where I created "Stardust ...
Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and private ...
Claude Code vulnerability could let malicious HTML steal SSH keys and tokens via its preview pane. See which risks developers ...
Next.js 16.4.1 and 15.5.28 fix two critical RCE flaws, including CVE-2026-96889 in SVG image optimization, plus a Server ...
Next.js patches two critical RCE flaws involving typed arrays and SVG processing, plus a Server Actions DoS affecting App ...
某些結果已隱藏，因為您可能無法存取這些結果。
顯示無法存取的結果