Skip to content
chornous.dev

Type two or more letters. Esc closes.

Index of sheets
Theme

Sheet 03 · Tags / Node.js

All topics

#Node.js

3 posts · 0 projects

AWriting

  1. Node.js 22.23.4, 24.22.1 and 26.12.1: a Brotli out-of-bounds write, three TLS hostname bypasses and repeated random UUIDsThe Node.js project shipped security releases for 22.x, 24.x and 26.x on October 21, 2026. They fix ten CVEs, four rated high, including an out-of-bounds write in the bundled Brotli decoder (CVE-2026-111497) and TLS hostname checks that non-canonical IPv4 spellings could fool.
  2. GitHub Actions runners dropped Node 20: JavaScript actions run on Node 24 nowOn September 23, 2026 GitHub removed Node 20 from Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out. JavaScript actions run on Node 24, and self-hosted runners on macOS 13.4 or older and ARM32 lost support.
  3. Node.js 26 goes LTS in October, with Temporal switched onNode.js 26 enables the Temporal API by default, adds Map.getOrInsert and Iterator.concat, and removes a batch of long-deprecated APIs. Test these before it becomes the LTS line next month.