pwned.coffeeUpdated 35 min ago

The menu

Node.js

Operational

Nothing about Node.js is on fire right now. We'd tell you. Probably.

1 spill in 2026 for Node.js

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector vm2 (npm) ## Reporter - Name or handle: `[YMsora]` - Report date: 2026-08-14 ## Summary The latest published vm2 release, **3.11.5**, and the current `main` branch are vulnerable to a sandbox escape when used on Node.js 26. An ordinary fulfilled Promise created by an async function can retain an attacker-controlled `constructor[Symbol.species]` across… fixed in vm2 3.11.7CVE-2026-929445 sources

More in Web & runtimes

Follow Node.js

RSS: /feed.xml?stack=node. JSON: /incidents.json?stack=node. Or add it to your usual for delivery.