Ulises Gascón

11 Nov 2024

🌍 Hello, BlueSky! 🤠 I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource. I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶 👉 Check out my projects and support my work: github.com/sponsors/Uli...

github.com@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets### Impact `@fastify/express` versions `>= 4.0.5, < 4.0.9`, when Fastify runs with `routerOptions.ignoreDuplicateSlashes: true`, match path-scoped Express middleware against a URL whose duplicate-...

🚨 Critical-severity security fix in @fastify/express@4.0.9 just released! Patches CVE-2026-112362: @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets github.com/fastify/fast...

github.com@fastify/session vulnerable to session revocation bypass via a logout race condition### Impact `@fastify/session` documents `Session#destroy()` as removing the session from the store. With the default `rolling: true`, a request that restored a session before a logout can still ...

🚨 Low-severity security fix in @fastify/session@11.1.6 just released! Patches CVE-2026-117499: @fastify/session vulnerable to session revocation bypass via a logout race condition github.com/fastify/sess...

Just shipped a new newsletter to Sponsors! 🎁 Covers the OpenJS CNA coordinated break 🏝️ , NodeConf EU in Bologna, the week everyone patched everything (eMudhra, php2shell, node2shell), 78 CVEs, 17 releases & more 🧯 Early access & support my OSS work: github.com/sponsors/Uli...

patchtheplanet.orgBrotli vulnerability (CVE-2026-111497) — Patch the PlanetBrotli decoder vulnerability: affected software, fixed releases, and how to disable Brotli decoding while you patch.

🧑‍💻 Behind every CVE there are humans working hard to release fixes fast, often as volunteers. The fix is the visible part. Triage, testing and coordination are not. Thanks to #PatchThePlanet for naming them. Proud to be part of it. patchtheplanet.org/brotli

github.combody-parser vulnerable to Denial of Service via trailing bytes after a compressed request body### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a de...

🚨 High-severity security fix in body-parser 2.4.0 and 1.20.9 just released! Patches CVE-2026-111181: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body github.com/expressjs/bo...

github.commulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while an...

🚨 High-severity security fix in multer@2.5.0 just released! Patches CVE-2026-113872: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown github.com/expressjs/mu...

github.comRelease 2.4.2 · jshttp/on-finishedHighlights 🔧 Node.js deprecation isFinished(res) now reads writableEnded instead of the deprecated finished property (DEP0136), with a fallback to finished on older Node.js versions. No behavior c...

🚀 Just released on-finished@2.4.2 📦️️️️️️️️️️️️ 🍿 #release details: github.com/jshttp/on-fi...

github.comRelease 4.4.0 · pillarjs/hbsHighlights 🔒 Security Bumped handlebars to 4.7.10, which addresses CVE-2026-106445 (GHSA-p8wg-vrv2-v86f), GHSA-8r5x-fm3f-whwj and GHSA-xw65-4hp5-5hc7. Please upgrade. (#283) ⚙️ Handlebars options...

hbs@4.4.0 is out 🎉 🔒️ handlebars@4.7.10 fixes 3 security advisories ⚙️ compileOptions + runtimeOptions to tune handlebars per instance 🧩 Clear error on `settings` render-local collisions 📚 Docs for layouts and template inheritance Thanks to everyone who contributed! github.com/pillarjs/hbs...

github.comRelease v2.5.0 · expressjs/multerImportant: Security Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) What's Changed docs: fix typo in .none() and grammar in .any() by @haimingZZ in #1485 fix: don't add a failed upload to the abort cl...

🚀 Just released multer@2.5.0 📦️️️️️️️️️️️ 🍿 #release details: github.com/expressjs/mu...

github.comRelease 1.20.9 · expressjs/body-parserImportant: Security Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828) What's Changed Release: 1.20.9 by @UlisesGascon in #779 Full Changelog: 1.20.8...1.20.9

🚀 Just released body-parser@1.20.9 📦️️️️️️️️️️ 🍿 #release details: github.com/expressjs/bo...

github.comRelease v2.4.0 · expressjs/body-parserImportant: Security Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828) What's Changed build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #737 chore: group github a...

🚀 Just released body-parser@2.4.0 📦️️️️️️️️️️ 🍿 #release details: github.com/expressjs/bo...

github.comRelease v6.1.0 · webpack/webpack-dev-serverMinor Changes Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @alexander-akait in #5765) Fix client progress modes, socket ...

🚨 webpack-dev-server shipped a security release fixing 2 CVEs (1 high, 1 medium) in 5.x and 6.x: cross-origin WebSocket access on proxied upgrades, and a Host-validation info leak. Upgrade to 5.2.7 or 6.1.0. github.com/webpack/webp...

Ulises Gascón reposted

Ruy Adorno

@ruyadorno.com

Time to update node 💚

Ulises Gascón@ulisesgascon.com

The patch is included in the security relases: 👉 Node@26.12.1 👉 Node@24.22.1 👉 Node@22.23.4 nodejs.org/en/blog/vuln...

nodejs.orgNode.js — Wednesday, October 21, 2026 Security ReleasesNode.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Ulises Gascón reposted

patak

@patak.cat

update node to deal with the eMudhra intermediate CA compromise!

Ulises Gascón@ulisesgascon.com

The patch is included in the security relases: 👉 Node@26.12.1 👉 Node@24.22.1 👉 Node@22.23.4 nodejs.org/en/blog/vuln...

github.comtls: reject chains containing blocked public keys by UlisesGascon · Pull Request #66871 · nodejs/nodeNode.js embeds the Mozilla root store but has no equivalent of the browsers' CRLSet/OneCRL and no default online revocation checking. When an intermediate CA key is compromised, a chain through...

Node.js will reject TLS chains that use any of the 8 compromised eMudhra (emSign) intermediate keys, ported from Electron and matching Go and the blocks Chrome and Firefox already ship. Blocks by public key, so reissued certs don't get through. github.com/nodejs/node/...

gist.github.comeMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check)eMudhra/emSign Oct 2026 intermediate compromise: what a root store update covers (reproducible check) - README.md

A reasonable question came up: isn't the root removal enough? The answer depends on which trust store you use. The script below lets anyone check it in a minute, in a throwaway container, using only public data gist.github.com/UlisesGascon...

The patch is included in the security relases: 👉 Node@26.12.1 👉 Node@24.22.1 👉 Node@22.23.4 nodejs.org/en/blog/vuln...

github.com@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch### Impact `@fastify/middie` versions prior to `9.3.6` join a path-scoped middleware's mount path to the plugin scope prefix in a way that can diverge from the path Fastify's router serves. When t...

🚨 Critical-severity security fix in @fastify/middie@9.3.6 just released! Patches CVE-2026-112712: @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch github.com/fastify/midd...

Ulises Gascón reposted

Filippo Valsorda

@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

Ulises Gascón reposted

Seth Larson

@sethmlarson.dev

Please upgrade certifi in all Python applications to the latest version (2026.10.19) following emSign CA certificate security incident: github.com/certifi/pyth... #security #python #vulnerability

github.comRemoval of emSign root cerificateCertifi 2026.10.18 removes root certificates from "emSign" from the root store. These root certificates have intermediates which have been revoked due to key compromise. A compromised key for a ...

github.comRelease v4.2.3 · fastify/fast-uriSecurity This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3. Medium — URI scheme...

🚨 fast-uri just shipped a coordinated security release fixing 4 CVEs (2 medium, 2 low) across the 2.x, 3.x, and 4.x lines: URI scheme spoofing, host confusion, scheme injection, and improper path equivalence. Upgrade to 2.4.8, 3.1.9, or 4.2.3. github.com/fastify/fast...

github.com@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback### Impact `@fastify/oauth2` clears the `oauth2-redirect-state` and `oauth2-code-verifier` cookies at the OAuth callback so that a `state` value cannot be replayed once it has been used. In the de...

🚨 Medium-severity security fix in @fastify/oauth2@8.3.2 just released! Patches CVE-2026-110008: @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback github.com/fastify/fast...

github.com@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults### Impact `@fastify/jwt` lets you configure global `sign` and `verify` defaults (such as `expiresIn`, `notBefore`, and `maxAge`) that the plugin is documented to apply unless a call overrides the...

🚨 Medium-severity security fix in @fastify/jwt@10.2.5 just released! Patches CVE-2026-110024: @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults github.com/fastify/fast...

github.comRelease v8.12.2 · nodejs/undiciSecurity fixes High severity Denial of service via TLS 1.2 certificate-changing renegotiation CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm A malicious or compromised HTTPS server could crash the Node.js pr...

🚨 undici just shipped a coordinated security release fixing 8 CVEs (4 high, 4 medium) across the 6.x, 7.x, and 8.x lines: process-crash DoS, TLS certificate validation bypass, Subresource Integrity bypass, and cache poisoning. Upgrade to 6.29.1, 7.30.1, or 8.12.2. github.com/nodejs/undic...

github.comfastify vulnerable to header validation bypass via case-sensitive propertyNames### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request header names in lowercase. This normalization does not reach the header names ...

🚨 Low-severity security fix in fastify@5.12.6 just released! Patches CVE-2026-107832: fastify vulnerable to header validation bypass via case-sensitive propertyNames github.com/fastify/fast...

🎉 express@5.3.0 adds conditional revalidation for QUERY requests

github.comRelease v5.3.0 · expressjs/expressHighlights 🐞 Bug fixes Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893 Fixed the behavior of res.send() to prevent conflicts between ...

express@5.3.0 is out 🎉 🔒 5 CVEs fixed in qs, body-parser and proxy-addr 🔄 304 revalidation for QUERY requests ⚡ ~1.5x faster Content-Type parsing in res.send() 🪵 Error handler logs the full error, cause included Thanks to everyone who contributed! github.com/expressjs/ex...

github.com@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports### Impact `@fastify/reply-from` proxies requests to a configured upstream. In affected versions, all three built-in HTTPS transports (the default undici client, the `http` client, and the `http2`...

🚨 High-severity security fix in @fastify/reply-from@12.7.0 just released! Patches CVE-2026-107318: @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports github.com/fastify/fast...

expressjs.comSeptember 2026 Security Releases · Express.jsSecurity releases for compression, cookies, hbs, morgan, multer, multiparty, and proxy-addr have been published. We recommend that all users upgrade as soon as possible.

🔒️️️️ Security update: Check out the September 2026 #Security Releases for #Express Stay safe out there 🫡 expressjs.com/en/blog/2026...

github.com@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed### Impact `@fastify/jwt` accepts `expiresIn`, `notBefore`, and `maxAge` as either a number of seconds or a time-span string, as declared in its type definitions. When a span string cannot be pars...

🚨 Medium-severity security fix in @fastify/jwt@10.2.3 just released! Patches CVE-2026-107275: @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed github.com/fastify/fast...

Ulises Gascón reposted

patak

@patak.cat

If you'd like to contribute to an oss project, don't focus on creating PRs. Help the maintainers triage issues and review existing PRs. Test beta releases, and give feedback about new APIs and features. Join the community and be around to help others. They need your care way more than your code now.

Ulises Gascón reposted

Matteo Collina

@nodeland.dev

Big shoutout to @GitHub this week. In two days, they shipped a stack of security advisory updates that maintainers have been asking for for a long time. 🛡️

Ulises Gascón reposted

NodeConf.eu

@nodeconf.eu

Thank you everyone for joining us at #NodeConfEU 2026! 💚 We hope you enjoyed it as much as we did, and we can’t wait to see you again next year! 📅👩‍💻 #TechCommunity #NodeCommunity

github.com@fastify/static vulnerable to route guard bypass via path case-folding### Impact `@fastify/static` permits a route-guard or `allowedPath` bypass when the letter case of a path segment is altered, on a case-insensitive filesystem (Windows and the default macOS volume...

17 Sept

🚨 Medium-severity security fix in @fastify/static@10.1.4 just released! Patches CVE-2026-90982: @fastify/static vulnerable to route guard bypass via path case-folding github.com/fastify/fast...

github.com@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet### Impact `@fastify/proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. This fork of `proxy-addr` inherited the same logic as the vulnerable u...

16 Sept

🚨 Critical-severity security fix in @fastify/proxy-addr@5.1.1 just released! Patches CVE-2026-92395: @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet github.com/fastify/prox...

github.com@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth### Impact `@fastify/auth` composes multiple authentication functions with AND/OR relations, including nested arrays (for example `fastify.auth([f1, [f2, f3]], { relation: 'or' })` meaning `f1 OR ...

16 Sept

🚨 High-severity security fix in @fastify/auth@5.1.1 just released! Patches CVE-2026-92087: @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth github.com/fastify/fast...

github.comfastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses### Impact `fastify` crashes with an uncaught `ERR_HTTP2_INVALID_CONNECTION_HEADERS` exception when a route that registers a response trailer via `reply.trailer()` is served over HTTP/2. Fastify...

16 Sept

🚨 Medium-severity security fix in fastify@5.12.5 just released! Patches CVE-2026-92081: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses github.com/fastify/fast...

github.comfast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization### Impact `fast-uri`'s `mailto` scheme parser compares each query field name to the reserved names (`to`, `subject`, `body`) while the name is still percent-encoded, and only percent-decodes it...

🚨 Medium-severity security fix in fast-uri@4.1.5 just released! Patches CVE-2026-86818: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization github.com/fastify/fast...

github.comfast-uri vulnerable to inconsistent host case normalization via percent-encoded octets### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. F...

🚨 Medium-severity security fix in fast-uri 4.1.5, 3.1.8, and 2.4.7 just released! Patches CVE-2026-86472: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets github.com/fastify/fast...

github.comRelease 2.0.8 · jshttp/proxy-addrImportant Fix CVE-2026-90711 (GHSA-jqcg-44mw-7w3h) What's Changed Add OSSF scorecard action by @carpasse in #27 Fix ci pipeline and add missing Node.JS versions by @carpasse in #26 [StepSecurity...

🚀 Just released proxy-addr@2.0.8 📦️️️️️️️️️ 🍿 #release details: github.com/jshttp/proxy...

github.comproxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet### Impact `proxy-addr` determines which network hops are trusted proxies so that `X-Forwarded-For` can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address ...

🚨 Critical-severity security fix in proxy-addr@2.0.8 just released! Patches CVE-2026-90711: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet github.com/jshttp/proxy...

github.commoment vulnerable to Path Traversal via crafted non-string locale name### Impact moment before 2.31.0 is vulnerable to path traversal in `moment.locale()`. When an application passes a non-string, attacker-influenced value to `moment.locale()`, a specially crafted...

🚨 Medium-severity security fix in moment@2.31.0 just released! Patches CVE-2026-17495: moment vulnerable to Path Traversal via crafted non-string locale name github.com/moment/momen...

github.commulter vulnerable to Denial of Service via orphaned disk writes on aborted uploads### Impact Multer's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an in...

🚨 Medium-severity security fix in multer@2.4.0 just released! Patches CVE-2026-88932: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads github.com/expressjs/mu...

🎉 multer@2.4.0 finally supports Google Cloud Functions and Firebase with the new streamHandler option

github.comRelease v2.4.0 · expressjs/multerHighlights multer finally supports Google Cloud Functions and Firebase 🎉 These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty re...

multer@2.4.0 is out 🎉 🔒 Security fix (CVE-2026-88932) ☁️ Google Cloud Functions / Firebase supported via the new streamHandler option 📏 Per-request limits: pass a function 🧾 err.filename tells you which file broke the size limit ⚡ Misconfigured limits now fail at startup github.com/expressjs/mu...

github.comRelease v4.22.3 · expressjs/expressWhat's Changed Update path-to-regexp to 0.1.13 to fix CVE-2026-4867 by @baryman in #7135 feat: allow conditional revalidation for QUERY requests (v4) by @Cherry in #7377 deps: qs@~6.16.0 by @lazer...

🚀 Just released express@4.22.3 📦️️️️️️️️ 🍿 #release details: github.com/expressjs/ex...

openjsf.orgThe OpenJS Foundation CNA is taking a coordinated break: September 17 to October 6, 2026 | OpenJS FoundationTo combat volunteer burnout driven by a surge in AI-generated vulnerability reports, the OpenJS Foundation CNA will temporarily pause all security operations from September 17 to October 6, 2026. This...

12 Sept

🫶 As part of the @openjsf.org #CNA, we also want to encourage #maintainers, in our projects and beyond, to give themselves permission to take a break. #Burnout is real for #maintainers, especially in #security work. openjsf.org/blog/the-ope...

github.comcompression vulnerable to Denial of Service via memory leak on premature response close### Impact A vulnerability in compression `< 1.8.2` allows an attacker to trigger a Denial of Service (DoS) by disconnecting while a compressed response is being sent. When the client aborts the...

11 Sept

🚨 High-severity security fix in compression@1.8.2 just released! Patches CVE-2026-87776: compression vulnerable to Denial of Service via memory leak on premature response close github.com/expressjs/co...

github.comRelease v1.8.2 · expressjs/compressionImportant Fix CVE-2026-87776 (GHSA-vc2v-76pw-4v95) What's Changed chore: add funding to package.json by @bjohansebas in #248 build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by @depe...

11 Sept

🚀 Just released compression@1.8.2 📦️️️️️️️ 🍿 #release details: github.com/expressjs/co...