Tecnología y otros placeres
We launched Café con CVEs, a show about Node.js security in Spanish, and I lived through every maintainer's nightmare at the first Repository Under Attack red team workshop. Plus why we reject around 95% of Lodash vulnerability reports, 15 CVEs patched across undici, fast-uri, the Fastify plugins, and body-parser, and plenty of awesome people doing awesome things.
The Express team has released body-parser 1.20.6 and 2.3.0, addressing CVE-2026-12590, a low-severity vulnerability where an invalid limit option value silently disabled request body size enforcement, allowing arbitrarily large payloads and potential denial of service. Invalid limit values now throw an error at parser construction time.
Cerca del 95% de los reportes de seguridad que recibe Lodash se rechazan, incluso cuando la prueba de concepto funciona. Aquí explico cómo el threat model decide dónde termina un bug de la librería y empieza uno de la aplicación, los patrones que seguimos cerrando y la única pregunta que deberías hacerte antes de reportar.
Around 95% of the security reports Lodash receives get rejected, even when the proof of concept runs. Here is how the threat model decides where a library bug ends and an application bug begins, the patterns we keep closing, and the one question to ask before you file.
The OpenJS Foundation's Q2 2026 security report focuses on maturing advisory operations: a proof-of-concept CNA API to automate CVE creation, routing, and publishing; a new open-source GHSA Dashboard giving an 18-panel view of advisory state, severity, and time-to-publish; and a year-one look at the OpenJS CNA, which jumped from 3 CVEs in late 2025 to 49 by mid-2026 amid a wave of AI-assisted…
After a rough, overloaded stretch, I have taken on a new role as the Node.js AI Security Engineer in Residence, funded by Alpha-Omega. From there we dig into the OpenJS CNA API PoC I built to let projects manage their own CVEs, with Node.js adoption now underway, and why npm@12 blocking install scripts only stops install-time attacks while execution-time becomes the next target. Plus a heavy…
npm v12 disabling automatic install scripts is a real step forward, but it moves supply chain attacks from install-time to execution-time rather than ending them: a malicious dependency still runs the moment you import it. The article walks through the recent wave of attacks, the Node.js threat model that trusts dependency code by default, and how the permission model, sandboxing, and CI egress…
It has been a while, so this is an extra-large update. Express got a full redesign and a new brand, the Node.js Collaborators Summit confronted an AI-driven flood of vulnerability reports, and a heavy security period brought 16 CVEs across the Fastify ecosystem, multiparty, morgan and more. Plus a new self-hosted dashboard for advisories, Maintainer Month, age assurance laws reaching open source,…
The Express team has released multiparty 4.3.0, addressing three high-severity denial of service vulnerabilities (CVE-2026-8159, CVE-2026-8161, and CVE-2026-8162) in the multipart form parser, ranging from ReDoS via filename parsing to prototype pollution and crashes from malformed percent-encoding.
A coordinated phishing campaign is targeting high-impact open source maintainers. Plus: Scorecard v6 evolving into a security evidence engine, 12 CVEs patched across undici, fastify, path-to-regexp and lodash, and a conversation about Node.js in production.
The Express team has released new patch versions of path-to-regexp addressing three security vulnerabilities (CVE-2026-4867, CVE-2026-4926, and CVE-2026-4923) that could lead to Regular Expression Denial of Service (ReDoS) attacks.
Starting with Node.js 27.x, the project transitions from two major releases per year to one annual release (in April), with every release becoming LTS—reducing complexity for maintainers and improving predictability for users.
This month we cover the upcoming Node.js release schedule changes starting with 27.x, the growing pressure of AI-generated security reports on maintainers, a heavy CVE triage month, and updates across the ecosystem.
The Express team has released a new patch version of multer addressing two high-severity security vulnerabilities (CVE-2026-3304 and CVE-2026-2359) that could lead to Denial of Service (DoS) attacks.
This month we tackle secure npm publishing, roll out a major security overhaul for Lodash, and continue the Express release train. Plus, updates on Node.js VFS and a new security guide for open source maintainers.
An overview of secure npm package publishing strategies in 2026, covering local publishing with strong 2FA, CI/CD with granular tokens, and Trusted Publishing. It discusses the Shai-Hulud worm attack, the revocation of classic tokens, and the importance of security in the npm ecosystem.
Una visión general de las estrategias de publicación segura de paquetes npm en 2026, cubriendo la publicación local con 2FA fuerte, CI/CD con tokens granulares y Trusted Publishing. Se analiza el ataque del gusano Shai-Hulud, la revocación de tokens clásicos y la importancia de la seguridad en el ecosistema npm.
CVE-2025-13465 is a prototype pollution vulnerability in Lodash that illustrates why not all prototype pollution issues are created equal. Rather than stemming from a generic misuse of __proto__, this vulnerability emerged from a specific API behavior and the assumptions built around it. By walking through the underlying problem, a practical proof of concept, and the reasoning behind a non-generic…
CVE-2025-13465 es una vulnerabilidad de prototype pollution en Lodash que ilustra por qué no todos los problemas de prototype pollution son iguales. En lugar de originarse en un uso genérico de __proto__, esta vulnerabilidad surge de un comportamiento específico de una API y de las suposiciones construidas a su alrededor. A través del análisis del problema subyacente, una prueba de concepto…
With the release of Lodash 4.17.23 and the publication of CVE-2025-13466, the project is making visible progress in strengthening its security posture.
Orbitant walks through how, the moment the news broke, they kicked off a rapid plan: scanning all their projects, pinpointing what was actually at risk, and securing it before anyone else even noticed. A behind-the-scenes look at what really happens when a threat hits production.
Orbitant cuenta cómo, al descubrir la noticia, activaron un plan exprés: escanear todos sus proyectos, detectar qué estaba en riesgo y protegerlo antes de que nadie más se enterara. Una mirada directa a lo que pasa detrás del telón cuando una amenaza golpea en producción.
This month brought a new talk, a deep dive into secure publishing, key Express releases, OSSF Scorecard updates, and several ecosystem improvements around security and governance.
Nos gusta culpar al código cuando el open source se rompe. La realidad es más incómoda: gobernanza, burnout y trabajo invisible son las verdaderas líneas de fractura. Esto es lo que aprendí trabajando con Express y Lodash.
We like to blame code when open source breaks. The reality is uglier: governance, burnout and invisible work are the real fault lines. This reflects what I learned during our work on Express and Lodash.
The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep evolving.
Following our Security Policy Update, we’ve completed a full security review across Yeoman’s organization. This milestone reinforces Yeoman’s foundation and ensures the project remains reliable and secure for the developer community.
This Halloween we exorcised some old code ghosts, patched vulnerabilities, and conjured new governance models. Lodash, Yeoman, and Express are looking more alive than ever!
Lodash inicia una nueva etapa con un modelo más colaborativo y sostenible. Este post detalla el plan para simplificar su mantenimiento, reforzar la seguridad y asegurar su papel clave en el ecosistema JavaScript durante los próximos años.
Lodash begins a new stage with a more collaborative and sustainable model. This post outlines the plan to simplify its maintenance, strengthen security, and ensure its key role in the JavaScript ecosystem for the coming years.
From the npm Shai-Hulud attack and emergency response, to GitHub’s Secure Open Source Fund, new Express releases, and the launch of the OpenJS AI Collaboration Space — this month has been packed with security milestones and community progress.
The Express team has released a new patch version of Multer addressing a high-severity security vulnerability, and a new minor version of on-headers addressing a low-severity security vulnerability
From CNA milestones to major security releases, updated threat models, and exciting book news. This summer has been packed with progress across open source security and the Node.js ecosystem.
The Express team has released a new patch version of Multer, addressing a high-severity vulnerability that could lead to a Denial of Service (DoS) attack.
The Express.js project has completed a major milestone in its ongoing commitment to security: the implementation of a formal, centralized vulnerability reporting and response process.
May’s Maintainer Month brought major updates across the ecosystem including critical security fixes in Multer, spring cleaning in Express.js with deprecated legacy packages, and the launch of over 30 library updates. The VisionBoard v1.0.0 milestone is underway, and a Node Congress talk on vulnerabilities is now available. A blackout in Spain also turned into the perfect moment to try a…
The Express team has released a new major version of Multer addressing two high-severity security vulnerabilities. This update improves the reliability and security of handling file uploads in Express applications.
As part of a broader effort to modernize and streamline Express.js, we’ve deprecated several outdated packages including csurf, connect-multiparty, and path-match. Learn why we made these changes and what it means for the future of the framework.
We're excited to announce a major set of improvements bringing us significantly closer to the v1.0.0 release of VisionBoard. This update strengthens the platform’s architecture, testing, and deployment—paving the way for new management and developer experience (DX) features.
Express 5.1 is now live as the default on npm, featuring a new LTS plan, migration codemods, and multiple related package updates. Node.js versions 20.19.1 and 22.15.0 were released with nearly 350 commits. A CI infrastructure incident postmortem was published, and Express debuted a fun new kawaii logo celebrating its high-speed, minimalistic spirit.
I authored the Nodejs v22.15.0 official release notes
I authored the Nodejs v20.19.1 official release notes
Recent open source security efforts include a new security policy for Yeoman, updates to Express.js vulnerability reporting, and upcoming talks at Node Congress and DevSecCon on threat modeling and securing the software supply chain. A sponsor-only repo is also in the works for focused discussions and newsletter archives.
This is just the start. We’re also working on a deeper security initiative to strengthen Yeoman for the long haul. If you’re curious or want to contribute, check out the discussion.
Yeoman is getting a fresh start with a new maintenance reboot. A revamped team is modernizing the architecture, improving the developer experience, and inviting contributors to help shape the project's future. It’s a big step toward keeping Yeoman relevant, reliable, and community-driven.
Express.js had a milestone year in 2024 with the release of Express 5.0, governance improvements, and stronger security. In 2025, the focus shifts to automation, scoped packages, enhanced protocols, and performance monitoring for even greater impact.
We’re thrilled to announce the relaunch of Yeoman’s maintenance for 2025. The new maintainers team, Ulises Gascon and Josh Goldberg, are stepping in to ensure this beloved project continues to thrive as a stable, reliable tool for developers.
Explore the transformative journey of Express.js in 2024, marked by governance improvements, the long-awaited release of Express 5.0, and heightened security measures. Look into the ambitious plans for 2025, including performance optimizations, scoped packages, and a bold roadmap for sustained growth in the Node.js ecosystem.
Kick off 2025 with fresh updates from the world of open source security. In this first newsletter, Ulises Gascón shares progress on OpenPathfinder, introduces two new CLI tools FortSphere and VisionBoard, and reflects on the support and collaboration from the community over the past year.
If you’re new to OpenPathfinder, this post will give you an overview of what we’re all about, including VisionBoard, FortSphere, and our project History. Plus, we’ve included a special demo video below—check it out!