Topic
Every article tagged Node.js Security, newest first.
A massive supply chain attack has hit the popular npm package Axios. Versions 1.14.1 and 0.30.4 deploy a stealthy Remote Access Trojan (RAT) via a fake dependency. Learn how to detect and remediate this critical threat.
A critical Arbitrary Code Execution vulnerability (CVE-2025-68613) has been discovered in n8n, allowing attackers to execute arbitrary code via workflow expressions. Upgrade to v1.122.0 immediately.
Looking for something specific?
Search every article by topic, tool or CVE.
Keep reading
GitHub Package Firewall brings install-time npm policy gates, SLSA attestation checks, and version cooldowns to AI coding agents and CI/CD runners.
Node.js CVE-2026-111497 exposes Brotli decoding to potential RCE. Check affected versions, fetch() exposure, WAF limits, and the October 2026 patch checklist.
PHP2Shell (CVE-2026-109618 & CVE-2026-109619) exposes 70% of the web to unauthenticated PHP RCE and memory leaks. Check fixed versions, IOCs, and mitigations.