Node.js publica parches de seguridad para diez vulnerabilidades, cuatro de ellas de alta severidad

·1 views

El 21 de octubre de 2026, el proyecto Node.js lanzó versiones de seguridad para sus líneas 22.x, 24.x y 26.x. Las actualizaciones corrigen diez fallos, cuatro de severidad alta, entre ellos una escritura fuera de límites en el decodificador Brotli. El fallo de Brotli fue reportado con ayuda de la herramienta de IA Codex Security de OpenAI y dos investigadores, y fue corregido por los mantenedores de Node.js. Total.js revisó las incidencias en sus frameworks 4 y 5, y ha añadido normalización y validación de nombres de host antes de DNS y TLS, mientras que los problemas restantes solo se resuelven actualizando Node.js.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Input Lag Can Mislead Developers: The Real Causes Behind Sluggish UIs

A developer describes users reporting sluggish input in a web app, where profiling pointed at JavaScript but the actual bottleneck was more complicated. The article explains that browsers pass input events through several stages, including OS processing, event coalescing, dispatch, and handler execution, any of which can introduce delay. It then outlines the rendering pipeline that follows JavaScript work, covering style recalculation, layout, paint, and compositing, which can postpone visible updates. The author notes that common DevTools signals such as Event Timing, Frames, and Long Tasks are easy to misread, since a handler may run late because of earlier work. Input latency therefore includes both event delay and render delay, and diagnosing it requires looking at the full pipeline rather than only the longest JavaScript task.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Meta open-sources code for building Muse AI gadgets

Meta has released open-source code that lets developers build gadgets powered by its Muse AI model. The article describes a builder who used the Amblyotube repository and the Muse model on a Raspberry Pi to create a gaze-tracking therapy setup for amblyopia. Muse's compact, quantized design allowed on-device inference at around 60 frames per second with a model under 4 MB. Fine-tuning on a few labeled sessions reportedly reduced calibration error from 2.4 degrees to 0.7 degrees. The author encourages others to assemble similar projects from the publicly available code on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Gating agent-written patches on fixture sensitivity instead of green test suites

A passing test suite can be weak evidence for an agent-authored patch, since tests may pass because they have stopped constraining behavior. The article proposes measuring how many deliberate breakages a fixture still catches, rather than only whether tests pass. Its approach combines property obligations, canary mutations, and a freeze registry with expiry, wired into a pre-merge check. The main risk described is fixture drift, where fixtures and assertions gradually loosen as patches are added. The gate is designed to detect this loss of test strength without assuming malicious intent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DREX: Can the Government Restrict How Citizens Spend Their Digital Real?

An analysis published on DEV Community examines whether Brazil's planned digital currency, DREX, could let authorities limit how people spend their money. The author explains that the Central Bank's chosen platform, Hyperledger Besu, supports programmable rules such as expiry dates and conditional transfers. He distinguishes between programmable contracts for specific operations and programmable money imposed on the currency itself, the latter being the main concern. According to the article, the Central Bank says programmability will be limited to bank tokenized deposits and voluntary retail contracts, with privacy protected by cryptographic tools. The author argues that the safeguards against misuse are legal and political rather than technical, so explicit legal protections are needed.

0 comments Read more at DEV Community