// stack
Node.js
Security incidents affecting node.js, React/Next.js and the JavaScript toolchain. Newest first.
- incidents
- 11
- live
- 2
- patched
- 8
## 11 Node.js incidents in the last year
through Oct 22, 2026- highlivepatchedsince Oct 21, 2026
Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)
› Node.js
On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.
CVE-2026-111497CVE-2026-105482CVE-2026-105483CVE-2026-106069+6 more - criticallivepartial fixsince Oct 7, 2026
tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
› tensorlake (npm)
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
GHSA-8g63-53c9-65j2 - criticalclosedpatchedclosed Oct 10, 2026
SubQuery @subql/common 5.8.3 published with credential stealer + backdoor
› @subql/common (npm) and downstream @subql/* packages
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
GHSA-9333-3c4x-x3h5MAL-2026-17571
show 8 older incidents8 older incidents
August 2026 1
criticalCHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)partial fix
› npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages) partial fix
In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.
May 2026 5
highNx Nx Console: Nx Console Embedded Malicious Code Vulnerabilitypatched
› Nx Nx Console patched
Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory. Added to CISA KEV on 2026-05-27.
open incident →CVE-2026-48027highTanStack TanStack: TanStack Unspecified Vulnerabilitypatched
› TanStack TanStack patched
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.
open incident →CVE-2026-45321criticalMini Shai-Hulud hits AntV / timeago.js npm ecosystempartial fix
› npm @antv/*, timeago.js, related packages under atool partial fix
May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.
highNext.js / React Server Components May 2026 security releasepatched
› Next.js; react-server-dom-webpack/parcel/turbopack patched
Coordinated May 6–7 2026 security release for React Server Components (CVE-2026-23870 DoS) and multiple Next.js advisories spanning middleware/proxy bypass, XSS, SSRF, cache poisoning and DoS. Upgrade Next.js to 15.5.18 or 16.2.6; react-server-dom-* to 19.0.6 / 19.1.7 / 19.2.6. Next.js 13.x/14.x had no planned patches.
open incident →CVE-2026-23870highOpenAI employee devices hit via TanStack Mini Shai-Hulud wavepatched
› TanStack-related npm packages / OpenAI employee endpoints patched
In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.
April 2026 1
highReact Server Components DoS CVE-2026-23869 (April Next.js advisory)patched
› Next.js App Router / React Server Components patched
April 8 2026 Next.js advisory GHSA-q4gf-8mx6-v5v3 tracks upstream CVE-2026-23869: crafted requests to App Router Server Function endpoints can cause excessive CPU / DoS. Patched in Next.js 15.5.15 and 16.2.3.
open incident →CVE-2026-23869
February 2026 1
highReact Native Community CLI: React Native Community CLI OS Command Injection Vulnerabilitypatched
› React Native Community CLI patched
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments. Added to CISA KEV on 2026-02-05.
open incident →CVE-2025-11953
