Node.js 25: Escapes from JavaScript sandbox vm2 conceivable

The vm2 sandbox component of the open-source JavaScript runtime environment Node.js is vulnerable with certain settings.
The Hacker News

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

CVE-2026-44009 (CVSS score: 9.8) - A vulnerability that allows sandbox escape via a null proto exception and permits an ...

Critical vm2 sandbox bug lets attackers execute code on hosts

A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary ...
腾讯网

Node.js 26 发布：默认启用 Temporal API，10 月进入 LTS 阶段

IT之家 5 月 6 日消息，当地时间 5 月 5 日，Node.js 团队发布了最新的 Node.js 26.0.0 版本（Current），Node.js 26 将于 10 月进入 LTS（长期支持）阶段。IT之家附主要更新内容如下：Temporal API：Temporal API 现在在 Node.js 26 中默认启用。Temporal 是一个用于 JavaScript 的现代日期 / ...
Analytics Insight

Top YouTube Channels for Node.js in 2026: Best Picks

Popular channel offering practical Node.js tutorials, REST API projects, and backend fundamentals with clear explanations ...
InfoQ中国 on MSN

Pulumi 新增对 Bun 运行时的全面支持

Pulumi 宣布，Bun 现在已经成为 Pulumi 完全支持的运行时环境，不再像之前那样只是作为包管理器的角色。随着 Pulumi 3.227.0 的发布，开发人员可以在 Pulumi.yaml 文件中设置 runtime: bun，然后由 Bun 执行整个基础设施程序，而不需要安装 Node.js。 在 2022 年首次发布时，Bun ...

Cross-platform development: React Native 0.85 gets new animation backend

The open-source framework introduces an experimental animation backend and outsources the Jest testing framework into its own package.
SecurityWeek

North Korean Hackers Target High-Profile Node.js Maintainers

The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign. After inviting Saayman to a Slack ...