Is Node.js safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days, including zero-days. If you run Node.js, update now.
Exploited in the last 90 days
- BrotliZero-dayA bug in a common compression library puts Node.js apps at risk
What to do: Upgrade Node.js; there is no workaround. Bun, Envoy, Python, .NET and PHP on Windows have also shipped fixes.
Fixed in: Node.js 22.23.4; 24.22.1; 26.12.1
Earlier exploited flaws
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 1 | 1 |
| 2025 | 0 | 0 |
| 2024 | 0 | 0 |
| 2023 | 0 | 0 |
| 2022 | 1 | 0 |
Questions
Is Node.js safe right now?
1 flaw was added to CISA's list of actively exploited vulnerabilities in the last 30 days, including zero-days. If you run Node.js, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many Node.js vulnerabilities have been exploited?
2 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks.
Covers products matching node.js, brotli. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.