Issue #645: Node security releases to fix a Brotli flaw

#645 — October 29, 2026

Together with

Node.js 26 'Lithium' Is Now the Active LTS Line — Node.js 26.13.0 promotes Node 26 to long-term support, with updates through April 2029, making it the new line to target for production. Node 24 has moved into maintenance and 22 remains in maintenance until April 2027 – the Node releases page has a neat graph to visualize this.

Node.js Release Team

💡 Meanwhile, Node 27's first alpha, the first release under Node's new annual release schedule, is being prepared and should land later today.

Build an Agent that Never Sleeps — Most agents stop when you close the chat. Learn to build one that keeps working: it triages incidents, asks your permission before risky fixes, and picks up where it left off after a crash.

Master.dev sponsor

Upgrade Now: Node's October Security Releases Fix a Brotli Flaw — Last week's releases (26.12.1, 24.22.1 and 22.23.4) fix ten CVEs, including a flaw in the bundled Brotli decoder, since dubbed Node2Shell, that can allow remote code execution if apps decompress malicious Brotli data, such as through node:zlib.

Node.js Project

IN BRIEF:

🔒 Express explains a body-parser bug where trailing bytes after a gzipped body can let a request crash a process. It's fixed in 2.4.0 and 1.20.9.
After a TSC vote, Node has merged a new experimental flag to strip types from TypeScript in node_modules, but only inside packages marked private, such as monorepo workspaces.
Electron 45 is out, moving to Chromium 156, V8 15.6 and Node 24.22. Sandboxed preload scripts lose the Buffer and setImmediate globals, and Electron 42 has now reached its end-of-life.
GitHub Actions workflow lockfiles are now generally available letting you pin actions and their dependencies in participating workflows.

The Web Can't Afford a JavaScript Runtime Monoculture — With Deno's runtime set to wind down after its team's move to Cloudflare, the field of major server-side runtimes could narrow to Node, Bun and workerd. An analyst draws on IE6, Chromium's dominance and the io.js fork to argue why that might worry us.

Kate Holterhoff (RedMonk)

💡 Meanwhile, Deno's team says it's working on getting Deno into a foundation, and an initial fork, Ende, has appeared.

Reylo: Import .sql Files into TypeScript with Full Type Inference — From the creator of Zod: write queries in plain .sql files and import them into TypeScript, with row and param types inferred from the SQL. No codegen step, but it relies on TypeScript 7.1's new content mappers (now in beta).

Colin McDonnell

Up to 10x Faster Postgres for I/O-Heavy Workloads — Managed Postgres on local NVMe, natively integrated with ClickHouse for real-time analytics.

ClickHouse Managed Postgres sponsor

📄 Why Parallel Publishes Can Briefly Break npm Installs – Monorepo releases can land before their own dependencies. Evert Pot (vlt)

📄 node:vfs: What Shipped, How It Works, and Its Limits Matteo Collina (Platformatic)

🛠 Code & Tools

Dependency Cruiser 18.7: Validate and Visualize Your Dependencies — Set rules about what may depend on what (no circular imports, say, or no reaching into another package's internals), check them in CI, and render the results as graphs. There's a page of graphs for real projects like Yarn and React.

Sander Verweij

OpenTelemetry JS 3.0 Released — OpenTelemetry's JavaScript SDK now ships dual ESM/CommonJS builds with strict exports maps (so deep imports break), and merges the Node, web and base trace SDKs into a single package.

OpenTelemetry

💡 Meanwhile, a new repo under the Node.js org, microtel, prototypes a minimal OpenTelemetry implementation meant to eventually land in Node itself.

bundle: Ship a Node App as One Signed File — Freezes a Node app and its dependency tree into a signed ZIP that Node 26's experimental virtual file system runs directly, with no npm install needed. Its author wrote several of the core VFS pieces it builds on.

Philipp Dunkel

gpuix-svelte: Native Desktop Apps from Svelte, No Webview — Draws Svelte components natively using GPUI, the GPU-powered UI framework behind Zed, while your code runs in Node or Bun. Experimental, as it relies on Svelte's unreleased custom renderers feature. GitHub repo.

Stanislav Khromov

sqlite-js-stream: Litestream, Rewritten for Node by an AI Agent — Litestream continuously streams SQLite's write-ahead log to S3 so a single-file database can be recovered. Platformatic has ported the Go tool to TypeScript running directly on node:sqlite.

Matteo Collina (Platformatic)

📰 Classifieds

🛒 AI agents are completing purchases for real customers. Fingerprint identifies them so you don’t block a sale. Learn how.

📄 Invoices in, JSON out. Pull line items, totals, dates and vendor details from invoice PDFs with Foxit's extraction API.

Chokidar 6.0 – A rewrite of the popular file watching library (above). v6 confirms changes against the filesystem before emitting events.
Verdaccio 7.0 – Lightweight, self-hostable private npm registry and proxy. v7 adds staged publishing and 2FA and requires Node 24+.
AVA 8.2 – Long-standing Node test runner. v8.1 can be up to 50% faster on many common workloads while 8.2 rolls out some fixes.
path-to-regexp 9.0 – Library that turns paths like /user/:name into regular expressions, as used by Express. Now ESM-only, with a subtle change to how ambiguous segments match.
Directus 12.6 – Connect any SQL database and get instant REST and GraphQL APIs, a visual management Studio, and a native MCP server for AI agents.
Croner 11.0 – Library to trigger functions or evaluate cron expressions.