Topic
4 articles
CyberSecureToday covers Node.js across 4 articles published between 1 Oct 2026 and 18 Oct 2026.
The coverage includes 4 vulnerability advisories. 4 advisories are rated critical or high severity.
Stories on Node.js most often intersect with Remote Code Execution, Cloud Security and vm2, with Technology, Cloud & SaaS the most affected sector. The most recent story, “AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
AWS CloudA prototype chain traversal flaw in AWS Amplify's velocity template engine allowed attackers with malicious VTL files to execute arbitrary local commands.
Threat IntelStrapi resolves a high-severity vulnerability (CVE-2023-22894) where password reset tokens and API secrets were stored unhashed in database audit records.
Threat IntelA critical sandbox escape in vm2 allows sandboxed scripts in Node.js 24+ to reach the node:test runner and invoke run() with arbitrary execArgv CLI flags.
Crypto / Web3A critical sandbox escape in vm2 allows untrusted NodeVM scripts to invoke OpenSSL engine loading via crypto.setEngine, executing arbitrary native code on the host.