The Hacker News

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

CVE-2026-44009 (CVSS score: 9.8) - A vulnerability that allows sandbox escape via a null proto exception and permits an ...

Node.js 25: Escapes from JavaScript sandbox vm2 conceivable

The vm2 sandbox component of the open-source JavaScript runtime environment Node.js is vulnerable with certain settings.

Critical vm2 sandbox bug lets attackers execute code on hosts

A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary ...
InfoWorld

13 new critical holes in JavaScript sandbox allow execution of arbitrary code

Thirteen critical vulnerabilities have been found in the vm2 JavaScript sandbox package that could allow an attacker’s code ...
腾讯网

Node.js 26 发布：默认启用 Temporal API，10 月进入 LTS 阶段

IT之家 5 月 6 日消息，当地时间 5 月 5 日，Node.js 团队发布了最新的 Node.js 26.0.0 版本（Current），Node.js 26 将于 10 月进入 LTS（长期支持）阶段。IT之家附主要更新内容如下：Temporal API：Temporal API 现在在 Node.js 26 中默认启用。Temporal 是一个用于 JavaScript 的现代日期 / ...
InfoWorld

Is your Node.js project really secure?

Node.js does not need more theatrical security output. It needs better developer workflow infrastructure. It needs tools that ...
Analytics Insight

Top YouTube Channels for Node.js in 2026: Best Picks

Popular channel offering practical Node.js tutorials, REST API projects, and backend fundamentals with clear explanations ...

Bun posts Rust porting guide, says rewrite is still half-baked

Bun creator Jarred Sumner has posted a Zig-to-Rust porting guide, igniting speculation that the project may migrate away from ...
腾讯网

Bun发布Zig转Rust移植指南，重写计划尚未确定

Bun的创始人Jarred ...
InfoQ中国 on MSN

Pulumi 新增对 Bun 运行时的全面支持

Pulumi 宣布，Bun 现在已经成为 Pulumi 完全支持的运行时环境，不再像之前那样只是作为包管理器的角色。随着 Pulumi 3.227.0 的发布，开发人员可以在 Pulumi.yaml 文件中设置 runtime: bun，然后由 Bun 执行整个基础设施程序，而不需要安装 Node.js。 在 2022 年首次发布时，Bun ...