Everything NetSec Observer has reported about Node.js: 3 stories, newest first. Part of our Vulnerabilities coverage.
A high-severity flaw in follow-redirects versions 1.16.0 through 1.16.0.99 allows remote servers to harvest authentication headers when applications use array-based header formats.
A regex flaw in follow-redirects 1.16.0 allows sensitive headers to leak to attacker-controlled targets during cross-origin redirects.
An unquoted filename flaw in Video-stitch allows attackers to run shell commands with Node.js privileges via specific video processing functions.