Do Son A key npm maintainer's account was compromised, leading to a supply chain attack. Malicious code in popular packages is stealing crypto during transactions.
Node.js
A critical flaw in the widely used sha.js library (CVE-2025-9288) can lead to hash collisions and private key extraction, threatening web applications.
A critical directory traversal vulnerability (CVE-2025-48387) in the popular NPM package tar-fs allows attackers to write arbitrary files and gain RCE.
A critical flaw (CVE-2025-54782, CVSS 9.4) in NestJS's devtools-integration package allows attackers to execute code on a developer's machine via a malicious website.
Check Point Research exposes JSCEAL, a stealthy malware campaign using malvertising and fake apps to steal crypto credentials and wallets via compiled JavaScript payloads.
A critical vulnerability (CVE-2025-54419, CVSS 10.0) in Node-SAML allows attackers to bypass SAML 2.0 authentication by manipulating unsigned assertion data.
OpenJS Foundation released critical Node.js updates patching two high-severity flaws (CVE-2025-27210, CVE-2025-27209) affecting Windows apps, including path traversal bypass and HashDoS.
Two critical flaws (CVE-2025-6545, CVE-2025-6547, CVSS 9.1) in pbkdf2 npm package allow silent compromise of cryptographic keys. Update to 3.1.3+ immediately!
CVE-2025-4318 (CVSS 9.5) hits AWS Amplify Codegen UI with PoC exploit. RCE flaw puts CI/CD pipelines and developer environments at high risk.
A study reveals widespread path traversal (CWE-22) in open-source projects, exacerbated by LLMs generating insecure code. Automated detection and patching are critical.
High DoS risk in Multer! These flaws threaten millions of Node.js applications. Update now to avoid these attacks.
Node.js Alerts: High-Severity Flaw (CVE-2025-23166) Risks Remote System Crashes! Update Immediately!
Node.js Alerts: High-Severity Flaw (CVE-2025-23166) Risks Remote System Crashes! Update Immediately!
Node.js security patches address high-severity CVE-2025-23166, risking remote crashes, and other flaws. Update your 20.x-24.x lines now!
Malicious npm packages are targeting Telegram bot developers, installing SSH backdoors and stealing data. Learn how this supply chain attack works and how to protect yourself.
Threat actors abuse Node.js in malvertising campaigns to steal data and deliver malware via fake crypto installers and stealthy PowerShell scripts.
CVE-2025-29774 & CVE-2025-29775 pose serious security risks. Learn how this vulnerability affects xml-crypto in your Node.js applications.
Learn about Node.js EOL and the recent changes in vulnerability management for End-of-Life versions of Node.js.
Node.js security update: Patching high-severity vulnerability (CVE-2025-23083) that could allow unauthorized access to sensitive data.
Find out how the Node.js Project is enhancing security measures for EOL versions. Stay up-to-date and protect your applications from potential vulnerabilities.
Learn about the severe command injection flaw (CVE-2024-56334) in Node.js system information package and its potential impact on RCE and privilege escalation.
Learn about Wish Stealer, a potent Node.js-based malware that steals sensitive information from Discord, web browsers, and more.
The most severe vulnerability, CVE-2024-36138, is a bypass of an incomplete fix for a previous issue, CVE-2024-27980
CVE-2024-21512 stems from a Prototype Pollution vulnerability that could be exploited for remote code execution.