Node.js vulnerabilities in 2026: Node2Shell and the registry
October's Brotli out-of-bounds write gives remote code execution through fetch() and body parsing. Plus the TLS fixes shipped beside it, and why npm trusted publishing did not end supply-chain worms.
7 min read#nodejs#security#npm