--- title: "Node security releases to fix a Brotli flaw" publication: "Node Weekly" issue: 645 published_at: "2026-10-29" canonical_url: "https://nodeweekly.com/issues/645" --- Plus Node 26 goes LTS, typed .sql imports for TypeScript, OpenTelemetry JS 3.0, and the pains of a JS runtime monoculture. #​645 β€” October 29, 2026 [Read on the Web](https://nodeweekly.com/issues/645) Together with [![Master.dev\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_245/co_white,e_outline:17/cgiteem1q7kgf8yoheqo.png)](https://master.dev/courses/background-ai-agents/?utm_source=email&utm_medium=nodeweekly&utm_content=aiagentscooper) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/f0gg9aczxjjc0lxcgr7g.jpg)](https://nodejs.org/en/blog/release/v26.13.0) [Node.js 26 'Lithium' Is Now the Active LTS Line](https://nodejs.org/en/blog/release/v26.13.0) β€” Node.js 26.13.0 promotes Node 26 to long-term support, with updates through April 2029, making it the new line to target for production. Node 24 has moved into maintenance and 22 remains in maintenance until April 2027 – [the Node releases page](https://nodejs.org/en/about/previous-releases) has a neat graph to visualize this. Node.js Release Team πŸ’‘ Meanwhile, Node 27's [first alpha](https://github.com/nodejs/node/pull/67062), the first release under Node's [new annual release schedule](https://nodejs.org/en/blog/announcements/evolving-the-nodejs-release-schedule), is being prepared and should land later today. [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/fc046e7d.png)](https://master.dev/courses/background-ai-agents/?utm_source=email&utm_medium=nodeweekly&utm_content=aiagentscooper) [Build an Agent that Never Sleeps](https://master.dev/courses/background-ai-agents/?utm_source=email&utm_medium=nodeweekly&utm_content=aiagentscooper) β€” Most agents stop when you close the chat. Learn to build one that keeps working: it triages incidents, asks your permission before risky fixes, and picks up where it left off after a crash. Master.dev sponsor [Upgrade Now: Node's October Security Releases Fix a Brotli Flaw](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) β€” Last week's releases (26.12.1, 24.22.1 and 22.23.4) fix ten CVEs, including [a flaw in the bundled Brotli decoder](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high), since dubbed [_Node2Shell_](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/), that can allow remote code execution if apps decompress malicious Brotli data, such as through `node:zlib`. Node.js Project **IN BRIEF:** - πŸ”’ Express [explains a body-parser bug](https://expressjs.com/en/blog/2026-10-28-cve-2026-111181/) where trailing bytes after a gzipped body can let a request crash a process. It's fixed in 2.4.0 and 1.20.9. - After [a TSC vote](https://github.com/nodejs/TSC/issues/1900), Node has merged a new experimental flag to [strip types from TypeScript in `node_modules`](https://github.com/nodejs/node/pull/63869), but only inside packages marked private, such as monorepo workspaces. - [Electron 45](https://www.electronjs.org/blog/electron-45-0) is out, moving to Chromium 156, V8 15.6 and Node 24.22. Sandboxed preload scripts lose the `Buffer` and `setImmediate` globals, and Electron 42 has now reached its _end-of-life_. - GitHub Actions [workflow lockfiles are now generally available](https://github.blog/changelog/2026-10-28-github-actions-workflow-lockfiles-are-generally-available) letting you pin actions and their dependencies in participating workflows. [The Web Can't Afford a JavaScript Runtime Monoculture](https://redmonk.com/kholterhoff/2026/10/27/js-runtime-monoculture/) β€” With Deno's runtime set to wind down after its team's move to Cloudflare, the field of major server-side runtimes could narrow to Node, Bun and `workerd`. An analyst draws on IE6, Chromium's dominance and the io.js fork to argue why that might worry us. Kate Holterhoff (RedMonk) πŸ’‘ Meanwhile, Deno's team says it's [working on getting Deno into a foundation](https://github.com/denoland/deno/issues/37030#issuecomment-6310897867), and an initial fork, [Ende](https://blog.webb.page/WM-105), has appeared. [Reylo: Import `.sql` Files into TypeScript with Full Type Inference](https://reylo.dev/) β€” From the creator of Zod: write queries in plain `.sql` files and `import` them into TypeScript, with row and param types inferred from the SQL. No codegen step, but it relies on TypeScript 7.1's [new content mappers](https://devblogs.microsoft.com/typescript/announcing-typescript-7-1-beta/#content-mappers) (now in beta). Colin McDonnell [Up to 10x Faster Postgres for I/O-Heavy Workloads](https://clickhouse.com/campaigns/clickhouse-managed-postgres?utm_source=nodeweekly&utm_medium=sponsored-content&utm_campaign=2026-10-29_SponsoredLink_Clickhouse) β€” Managed Postgres on local NVMe, natively integrated with ClickHouse for real-time analytics. ClickHouse Managed Postgres sponsor πŸ“„ [Why Parallel Publishes Can Briefly Break npm Installs](https://www.vlt.io/blog/consistent-ish-graph) – Monorepo releases can land before their own dependencies. Evert Pot (vlt) πŸ“„ [`node:vfs`: What Shipped, How It Works, and Its Limits](https://blog.platformatic.dev/article-slug-node-vfs-nodejs-virtual-filesystem) Matteo Collina (Platformatic) πŸ›  Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/yfk5ezruwtf6osle2mkp.jpg)](https://github.com/sverweij/dependency-cruiser) [Dependency Cruiser 18.7: Validate and Visualize Your Dependencies](https://github.com/sverweij/dependency-cruiser) β€” Set rules about what may depend on what (no circular imports, say, or no reaching into another package's internals), check them in CI, and render the results as graphs. There's [a page of graphs for real projects](https://github.com/sverweij/dependency-cruiser/blob/main/doc/real-world-samples.md) like Yarn and React. Sander Verweij [OpenTelemetry JS 3.0 Released](https://github.com/open-telemetry/opentelemetry-js/blob/main/doc/3.x/migration-guide.md) β€” OpenTelemetry's JavaScript SDK now ships dual ESM/CommonJS builds with strict `exports` maps (so deep imports break), and merges the Node, web and base trace SDKs into a single package. OpenTelemetry πŸ’‘ Meanwhile, a new repo under the Node.js org, [microtel](https://github.com/nodejs/microtel), prototypes a minimal OpenTelemetry implementation meant to eventually land in Node itself. [bundle: Ship a Node App as One Signed File](https://bundle.pipobscure.com/) β€” Freezes a Node app and its dependency tree into a signed ZIP that Node 26's experimental virtual file system runs directly, with no `npm install` needed. Its author wrote several of the core VFS pieces it builds on. Philipp Dunkel [gpuix-svelte: Native Desktop Apps from Svelte, No Webview](https://gpuix-svelte.stanislav.garden/) β€” Draws Svelte components natively using [GPUI](https://gpui.rs/), the GPU-powered UI framework behind Zed, while your code runs in Node or Bun. Experimental, as it relies on Svelte's unreleased custom renderers feature. [GitHub repo.](https://github.com/khromov/gpuix-svelte) Stanislav Khromov [sqlite-js-stream: Litestream, Rewritten for Node by an AI Agent](https://blog.platformatic.dev/sqlite-js-stream-litestream-nodejs) β€” [Litestream](https://litestream.io/) continuously streams SQLite's write-ahead log to S3 so a single-file database can be recovered. Platformatic has ported the Go tool to TypeScript running directly on `node:sqlite`. Matteo Collina (Platformatic) πŸ“° Classifieds πŸ›’ AI agents are completing purchases for real customers. [Fingerprint](https://fingerprint.com/blog/how-to-detect-checkout-bots/?utm_source=NodeWeekly102926&utm_medium=newsletter) identifies them so you don’t block a sale. [Learn how](https://fingerprint.com/blog/how-to-detect-checkout-bots/?utm_source=NodeWeekly102926&utm_medium=newsletter). --- πŸ“„ [Invoices in, JSON out](https://developer-api.foxit.com/developer-blogs/api-guides-tutorials/invoice-parsing-pdf-to-structured-json/?utm_source=draftdev&utm_medium=newsletter&utm_campaign=nodeweekly_20261029). Pull line items, totals, dates and vendor details from invoice PDFs with [Foxit's extraction API](https://developer-api.foxit.com/developer-blogs/api-guides-tutorials/invoice-parsing-pdf-to-structured-json/?utm_source=draftdev&utm_medium=newsletter&utm_campaign=nodeweekly_20261029). [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/mzbu4tbh2l2opaj725sv.jpg)](https://github.com/paulmillr/chokidar/releases/tag/6.0.0) - [Chokidar 6.0](https://github.com/paulmillr/chokidar/releases/tag/6.0.0) – A rewrite of the popular file watching library _(above)_. v6 confirms changes against the filesystem before emitting events. - [Verdaccio 7.0](https://github.com/verdaccio/verdaccio) – Lightweight, self-hostable private npm registry and proxy. [v7 adds staged publishing and 2FA](https://verdaccio.org/blog/2026/10/25/verdaccio-7-release) and requires Node 24+. - [AVA 8.2](https://github.com/avajs/ava) – Long-standing Node test runner. [v8.1 can be up to 50% faster](https://github.com/avajs/ava/releases/tag/v8.1.0) on many common workloads while 8.2 rolls out some fixes. - [path-to-regexp 9.0](https://github.com/pillarjs/path-to-regexp) – Library that turns paths like `/user/:name` into regular expressions, as used by Express. [Now ESM-only](https://github.com/pillarjs/path-to-regexp/releases/tag/v9.0.0), with a subtle change to how ambiguous segments match. - [Directus 12.6](https://github.com/directus/directus) – Connect any SQL database and get instant REST and GraphQL APIs, a visual management Studio, and a native MCP server for AI agents. - [Croner 11.0](https://github.com/Hexagon/croner) – Library to trigger functions or evaluate cron expressions. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).