[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkDejVwq824bXpfMtaehrdKgpGyaFVTLSRtawO-24Moc":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"28243322-0856-4866-be58-213472d80e7c","After PHP and eMudhra, Here Comes Node.js","after-php-and-emudhra-here-comes-node-js-b95cae","Just a day after a huge effort for security teams to patch PHP and update CA Certificates thanks to eMudhra errors, Node.js drops a planned security release addressing significant issues including an RCE. Here's what you need to do, and where we disagree on Node.js' own severity assessment.","Node.js has released a planned security update to address several significant vulnerabilities, including a critical Remote Code Execution (RCE) flaw. This release comes shortly after security teams were busy patching PHP and addressing issues with eMudhra certificates, adding to the patching burden. The article also questions Node.js' own severity assessment of the vulnerabilities.","Node.js releases security update addressing critical RCE vulnerability.","https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fafter-php-and-emudhra-here-comes-node-js\u002F","https:\u002F\u002Fcheckmarx.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fcxzero_2026-10-cxzero-nodejs-security-release_image01.webp","2026-10-22T20:34:45+00:00","2026-10-22T22:00:10.610626+00:00",8,[17,20,22],{"name":18,"type":19},"Node.js","product",{"name":21,"type":19},"PHP",{"name":23,"type":24},"eMudhra","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,18,21],{"controls":51,"vendors":138},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":47,"name":111,"problem":112,"products":113},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"nodejs-critical-rce-highlights-growing-patch-fatigue-risk","Node.js Critical RCE Highlights Growing Patch Fatigue Risk","A critical Remote Code Execution vulnerability in Node.js, arriving closely behind similar urgent patches for PHP and eMudhra certificates, illustrates how organizations can be overwhelmed by simultaneous patching demands — a state known as patch fatigue. When security teams are stretched thin across multiple concurrent vulnerabilities, prioritization errors and delays become more likely, leaving critical flaws exploitable for longer windows. The article's note that Node.js' own severity assessment may be understated adds another layer of risk: organizations relying solely on vendor CVSS scores without independent validation could deprioritize a genuinely dangerous flaw. This matters because RCE vulnerabilities represent among the highest-impact vulnerability classes, allowing attackers to execute arbitrary code on affected servers, potentially leading to full system compromise.",[144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":152,"PCI DSS Requirement 6":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 17: Incident Response Management":155,"OWASP A06:2021 Vulnerable and Outdated Components":156,"CIS Control 7: Continuous Vulnerability Management":157,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":158},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies, meaning operators of Node.js-based services must have processes to rapidly respond to critical disclosures like this RCE.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches within defined timeframes, directly applicable to patching the critical Node.js RCE in any cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws on a schedule commensurate with risk — directly applicable to applying the Node.js RCE patch promptly and reassessing vendor-provided severity ratings.","Having a pre-defined incident response plan that includes emergency patching procedures ensures that when multiple critical vulnerabilities drop simultaneously, teams can triage and act without confusion or dangerous delays.","Node.js is a widely used runtime component; running unpatched versions directly maps to this risk category, which warns that using components with known vulnerabilities can lead to severe compromise including RCE.","A structured, continuous vulnerability management process would ensure Node.js instances are identified and patched on a defined SLA, preventing the delay that patch fatigue introduces during multi-vendor disclosure periods.","This control mandates timely identification and remediation of technical vulnerabilities, including maintaining an inventory of assets to know where vulnerable software versions are deployed — critical when juggling multiple simultaneous patches."]