CISA ordered federal agencies to patch a critical Node.js Brotli decoder flaw by November 10 after confirming active ...

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight updates to fix vulnerabilities that could crash millions more websites.

The Cybersecurity Administration urged immediate updates to PHP, Node.js and Go after vulnerabilities and an incident involving disclosed private keys.

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra certificates.