Node.js

Everything Patch Herald has reported about Node.js: 2 stories, newest first. Part of our Vulnerabilities coverage.

Nodemailer CVSS 8.7 Flaw Blocks Event Loop Until 10.0.13 Patch

A high-severity flaw in Nodemailer versions prior to 10.0.13 allows malicious SMTP servers to freeze applications by exploiting regex backtracking in authentication handling.

Oct 16, 2026

Vulnerabilities

9.3 CVSS: CVE-2026-107699 RCE in ppt2png 0.0.6 Node.js apps via shell metacharacter injection in path args

A critical flaw in the ppt2png tool lets attackers run system commands by manipulating file path inputs, posing a severe risk to Node.js applications.

Oct 9, 2026