#OpenSource Maintainer (Nodejs, Express, Lodash, Yeoman...), TC39 Delegate and #Maker | He/Him
Open remote profile ↗🚨 High-severity security fix in body-parser 2.4.0 and 1.20.9 just released!
Patches CVE-2026-111181: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
🚨 High-severity security fix in [email protected] just released!
Patches CVE-2026-113872: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m
🚀 Just released [email protected] 📦️️️️️️️️️️️️
🍿 #release details: https://github.com/jshttp/on-finished/releases/tag/v2.4.2
[email protected] is out 🎉
🔒️ [email protected] fixes 1 CVE + 2 advisories, please upgrade
⚙️ compileOptions: pass strict, noEscape… to handlebars.compile()
🛡️ runtimeOptions: restore handlebars' safer prototype-access defaults
🧩 Clear error when a `settings` local shadows Express settings
📚 Docs for layouts and template inheritance via partial blocks
Thanks to everyone who contributed!
🚀 Just released [email protected] 📦️️️️️️️️️️️
🍿 #release details: https://github.com/expressjs/multer/releases/tag/v2.5.0
🚀 Just released [email protected] 📦️️️️️️️️️️
🍿 #release details: https://github.com/expressjs/body-parser/releases/tag/1.20.9
🚀 Just released [email protected] 📦️️️️️️️️️️
🍿 #release details: https://github.com/expressjs/body-parser/releases/tag/v2.4.0
🚨 webpack-dev-server shipped a security release fixing 2 CVEs (1 high, 1 medium) in 5.x and 6.x: cross-origin WebSocket access on proxied upgrades, and a Host-validation info leak.
Upgrade to 5.2.7 or 6.1.0.
https://github.com/webpack/webpack-dev-server/releases/tag/v6.1.0
The patch is included in the security relases:
👉 [email protected]
👉 [email protected]
👉 [email protected]
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
🚨 Critical-severity security fix in @fastify/[email protected] just released!
Patches CVE-2026-112712: @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
https://github.com/fastify/middie/security/advisories/GHSA-5p92-8765-9fv8
A reasonable question came up: isn't the root removal enough? The answer depends on which trust store you use. The script below lets anyone check it in a minute, in a throwaway container, using only public data
https://gist.github.com/UlisesGascon/10ed0724930e5382b3ed48fa2b0d3e02
GisteMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check)eMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check) - README.md
Node.js will reject TLS chains that use any of the 8 compromised eMudhra (emSign) intermediate keys, ported from Electron and matching Go and the blocks Chrome and Firefox already ship. Blocks by public key, so reissued certs don't get through.
🚨 fast-uri just shipped a coordinated security release fixing 4 CVEs (2 medium, 2 low) across the 2.x, 3.x, and 4.x lines: URI scheme spoofing, host confusion, scheme injection, and improper path equivalence.
Upgrade to 2.4.8, 3.1.9, or 4.2.3.