• Sites and apps on Node.js 22, 24 and 26 that unpack Brotli data they did not make themselves.Node.js

  Brotli decoder flaw

  exploit code not published

  Compressed data built the wrong way can overwrite memory in an app or proxy that unpacks it, which can crash the app, leak memory or run an attacker’s code.

  Update Node.js to 22.23.4, 24.22.1 or 26.12.1, Bun to 1.4.4, or Envoy to a fixed release.

• Anyone who builds sites or apps with Node.js.Node.js

  The keyv npm worm

  being used in attacks

  Poisoned versions of keyv and related npm packages steal developer passwords and keys, then spread by poisoning more packages.

  No fix yet

Ask for the patch check→

Is my site affected?