El blog de Ulises Gascón

The OpenJS Foundation CVE Numbering Authority is pausing all operations from September 17 to October 6, 2026, to address volunteer burnout after a sharp rise in advisory requests, many of them AI-generated and requiring significant human review.

The Express security team is joining the OpenJS Foundation CNA coordinated break from September 17 to October 6, 2026.

The Express team has released hbs 4.3.0, multer 2.3.0 and morgan 1.12.0, addressing six vulnerabilities. hbs fixes a high-severity XSS where async helpers registered with registerAsyncHelper were not escaping output. multer fixes three high-severity denia…

We launched Café con CVEs, a show about Node.js security in Spanish, and I lived through every maintainer's nightmare at the first Repository Under Attack red team workshop.

The Express team has released body-parser 1.20.6 and 2.3.0, addressing CVE-2026-12590, a low-severity vulnerability where an invalid limit option value silently disabled request body size enforcement, allowing arbitrarily large payloads and potential deni…

Around 95% of the security reports Lodash receives get rejected, even when the proof of concept runs.

Cerca del 95% de los reportes de seguridad que recibe Lodash se rechazan, incluso cuando la prueba de concepto funciona.

The OpenJS Foundation's Q2 2026 security report focuses on maturing advisory operations: a proof-of-concept CNA API to automate CVE creation, routing, and publishing; a new open-source GHSA Dashboard giving an 18-panel view of advisory state, severity, and

After a rough, overloaded stretch, I have taken on a new role as the Node.js AI Security Engineer in Residence, funded by Alpha-Omega.

npm v12 disabling automatic install scripts is a real step forward, but it moves supply chain attacks from install-time to execution-time rather than ending them: a malicious dependency still runs the moment you import it.

It has been a while, so this is an extra-large update.

The Express team has released multiparty 4.3.0, addressing three high-severity denial of service vulnerabilities (CVE-2026-8159, CVE-2026-8161, and CVE-2026-8162) in the multipart form parser, ranging from ReDoS via filename parsing to prototype pollution…

A coordinated phishing campaign is targeting high-impact open source maintainers.

The Express team has released new patch versions of path-to-regexp addressing three security vulnerabilities (CVE-2026-4867, CVE-2026-4926, and CVE-2026-4923) that could lead to Regular Expression Denial of Service (ReDoS) attacks.

Starting with Node.js 27.x, the project transitions from two major releases per year to one annual release (in April), with every release becoming LTS—reducing complexity for maintainers and improving predictability for users.

This month we cover the upcoming Node.js release schedule changes starting with 27.x, the growing pressure of AI-generated security reports on maintainers, a heavy CVE triage month, and updates across the ecosystem.

The Express team has released a new patch version of multer addressing two high-severity security vulnerabilities (CVE-2026-3304 and CVE-2026-2359) that could lead to Denial of Service (DoS) attacks.

This month we tackle secure npm publishing, roll out a major security overhaul for Lodash, and continue the Express release train.

Una visión general de las estrategias de publicación segura de paquetes npm en 2026, cubriendo la publicación local con 2FA fuerte, CI/CD con tokens granulares y Trusted Publishing.

An overview of secure npm package publishing strategies in 2026, covering local publishing with strong 2FA, CI/CD with granular tokens, and Trusted Publishing.

CVE-2025-13465 es una vulnerabilidad de prototype pollution en Lodash que ilustra por qué no todos los problemas de prototype pollution son iguales.

CVE-2025-13465 is a prototype pollution vulnerability in Lodash that illustrates why not all prototype pollution issues are created equal.

With the release of Lodash 4.17.23 and the publication of CVE-2025-13466, the project is making visible progress in strengthening its security posture.

Orbitant cuenta cómo, al descubrir la noticia, activaron un plan exprés: escanear todos sus proyectos, detectar qué estaba en riesgo y protegerlo antes de que nadie más se enterara.

Orbitant walks through how, the moment the news broke, they kicked off a rapid plan: scanning all their projects, pinpointing what was actually at risk, and securing it before anyone else even noticed.

This month brought a new talk, a deep dive into secure publishing, key Express releases, OSSF Scorecard updates, and several ecosystem improvements around security and governance.

We like to blame code when open source breaks.

Nos gusta culpar al código cuando el open source se rompe.

The OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep evolving.

Following our Security Policy Update, we’ve completed a full security review across Yeoman’s organization.

This Halloween we exorcised some old code ghosts, patched vulnerabilities, and conjured new governance models.

Lodash begins a new stage with a more collaborative and sustainable model.

Lodash inicia una nueva etapa con un modelo más colaborativo y sostenible.

From the npm Shai-Hulud attack and emergency response, to GitHub’s Secure Open Source Fund, new Express releases, and the launch of the OpenJS AI Collaboration Space — this month has been packed with security milestones and community progress.

The Express team has released a new patch version of Multer addressing a high-severity security vulnerability, and a new minor version of on-headers addressing a low-severity security vulnerability

From CNA milestones to major security releases, updated threat models, and exciting book news.

The Express team has released a new patch version of Multer, addressing a high-severity vulnerability that could lead to a Denial of Service (DoS) attack.

The Express.js project has completed a major milestone in its ongoing commitment to security: the implementation of a formal, centralized vulnerability reporting and response process.

May’s Maintainer Month brought major updates across the ecosystem including critical security fixes in Multer, spring cleaning in Express.js with deprecated legacy packages, and the launch of over 30 library updates.

The Express team has released a new major version of Multer addressing two high-severity security vulnerabilities.

As part of a broader effort to modernize and streamline Express.js, we’ve deprecated several outdated packages including csurf, connect-multiparty, and path-match.

We're excited to announce a major set of improvements bringing us significantly closer to the v1.0.0 release of VisionBoard.

Express 5.1 is now live as the default on npm, featuring a new LTS plan, migration codemods, and multiple related package updates.

I authored the Nodejs v22.15.0 official release notes

I authored the Nodejs v20.19.1 official release notes

Recent open source security efforts include a new security policy for Yeoman, updates to Express.js vulnerability reporting, and upcoming talks at Node Congress and DevSecCon on threat modeling and securing the software supply chain.

This is just the start.

Yeoman is getting a fresh start with a new maintenance reboot.

Express.js had a milestone year in 2024 with the release of Express 5.0, governance improvements, and stronger security.

Explore the transformative journey of Express.js in 2024, marked by governance improvements, the long-awaited release of Express 5.0, and heightened security measures.