Everything Threat Times has reported about Node.js: 7 stories, newest first. Part of our Vulnerabilities coverage.
National Vulnerability Database records CVE-2020-37279 as a critical risk in the Node.js library, enabling arbitrary OS command execution through manipulated file paths.
Cloudflare has acquired Deno, co-founded by Node.js creator Ryan Dahl. The deal absorbs the team while winding down the independent Deno runtime project.
A high-severity vulnerability in the AWS CDK library allows attackers to execute arbitrary commands during Docker bundling of Node.js functions.
A high-severity SQL injection vulnerability in the MariaDB Connector/Node.js package has been patched after researchers discovered that unescaped object keys could execute arbitrary database commands.
A critical vulnerability in the dot-access package enables attackers to execute arbitrary operating system commands via crafted paths.
A critical vulnerability in ppt2png allows remote attackers to execute arbitrary system commands via unsanitized file path arguments.
The @enmaso/node-convert package contains a severe vulnerability allowing remote attackers to execute arbitrary system commands via crafted inputs.