Software: Node.js fixes 10 flaws, GitHub launches a firewall for npm packages

This week's most important software news shares one theme: the security of packages and access keys. Node.js fixed ten vulnerabilities, and GitHub introduced a filter for malicious npm packages and tokens that expire on their own. Here is what matters if your business runs a web app, an online store or internal software.

Node.js: ten fixes, one of them serious

On 21 October the Node.js project published security releases 22.23.4, 24.22.1 and 26.12.1. They fix ten vulnerabilities: four high, three medium and three low severity.

The most serious one (CVE-2026-111497) is in the bundled Brotli decoder. Malformed compressed input passed through node:zlib can crash the process, disclose memory or allow remote code execution. The other three high-severity issues affect domain and IP checks: DNS functions truncate hostnames at a NUL byte, which can defeat domain allowlists, and TLS verification misreads some IP address spellings, such as those with a leading zero.

The same releases update the bundled c-ares, OpenSSL, SQLite and Undici libraries and the CA certificate store, following the compromise of an eMudhra intermediate certificate. Versions that are out of support receive no fixes.

GitHub: a firewall for npm packages

On 20 October GitHub launched the package firewall in public preview. It sits between your machines, CI/CD hosts or AI coding agents and the public package registry. On every install it checks whether a package is flagged as malicious or vulnerable in the GitHub Advisory Database and whether there are signs of a supply-chain attack. Admins can set a cooldown period so freshly published versions are not installed straight away. If a package is blocked by mistake, users can request an exception.

For now it supports npm only and is available to GitHub Enterprise Cloud customers. It is free during the preview; at general availability it will be billed on metered usage, similar to GitHub Actions.

GitHub: fewer keys that never expire

Since 21 October GitHub CLI (version 2.103.0 or later) can use an access token that expires within hours and refreshes itself. You turn it on with gh auth login --expiring, or for every sign-in with gh config set expiring_credentials enabled. If such a token leaks, it stops working within hours instead of lasting indefinitely. GitHub plans to make this the default later.

Since 23 October installing GitHub Apps across an entire enterprise is generally available. With new permissions for repository policies, two-factor requirements and IP allowlists, apps can replace classic personal access tokens in more of your automation.

Smaller but useful: since 20 October all classic branch protection rules in a repository can be converted to rulesets in one step, and Dependabot now supports npm 12, pnpm 11 and 12 and Bun 1.4.

What it means for your business

1. Update Node.js this week. If your website, store or API runs on Node.js, move to 22.23.4, 24.22.1 or 26.12.1 and rebuild Docker images and packages that bundle Node.js. If you are on an unsupported version, plan the move to a supported one.
2. Do not install packages blindly. Set a rule that new dependency versions wait a few days before use and that versions are pinned in a lockfile. On Enterprise Cloud the package firewall can enforce this; on smaller plans, build the same rule into your tools and team process.
3. Replace long-lived tokens. List where personal tokens without an expiry date are in use and replace them with GitHub Apps or short-lived tokens.

If you want us to review the security and maintenance of your software, see our custom software service or get in touch.