Security Advisory - Updated 2026-06-24 - Node.js runtime
Node runtime batch: check expression, proxy, desktop, TLS, and cookie boundaries
This Node batch is about trusted boundaries inside application code: expression compilation, middleware coverage, proxy body handling, desktop runtime buffers, TLS compatibility, and cookie serialization. Patch dependencies, then review where user input or network traffic crosses those boundaries before validation.
Affected packages
| CVE | Package | Affected / fixed | Review | CVSS |
|---|---|---|---|---|
| CVE-2026-12866 | expr-eval | No fixed release | Remove untrusted toJSFunction use or replace expr-eval until a fixed release is available | 9.8 |
| CVE-2026-54257 | Electron | 42.3.1 / 42.3.2 | Upgrade Electron to 42.3.3 and rebuild affected desktop packages | 9.3 |
| CVE-2026-54281 | @nestjs/platform-fastify | < 11.1.24 | Upgrade NestJS to 11.1.24 or newer and review Fastify route middleware coverage | 8.7 |
| CVE-2026-55603 | http-proxy-middleware | 3.0.7 / 4.1.1 | Upgrade http-proxy-middleware to 3.0.7 or 4.1.1 and review fixRequestBody use | 7.5 |
| CVE-2026-44726 | Deno | 2.0.0-2.7.7 | Upgrade Deno to 2.7.8 or newer and review Node TLS compatibility clients | 7.4 |
| CVE-2026-56762 | Hono | < 4.12.12 | Upgrade Hono to 4.12.12 and review code that accepts user-controlled cookie names | 6.9 |
Owner self-check
grep -Rni '"expr-eval"\\|"electron"\\|"@nestjs/platform-fastify"\\|"http-proxy-middleware"\\|"hono"\\|"deno"' package.json package-lock.json pnpm-lock.yaml yarn.lock deno.json deno.lock 2>/dev/null
grep -Rni 'toJSFunction\\|new Parser\\|MiddlewareConsumer\\|forRoutes\\|FastifyAdapter\\|fixRequestBody\\|multipart/form-data\\|setCookie\\|serializeSigned\\|Deno.connectTls\\|autoSelectFamily' src server app 2>/dev/null | head -180
grep -Rni 'proxy\\|middleware\\|auth\\|unauthorized\\|validation\\|worker\\|secureConnect\\|cookie' logs var/log 2>/dev/null | tail -180What to review
- expr-eval: any use of `toJSFunction()` with expressions that come from users, tenants, scripts, formulas, dashboards, or workflow rules.
- Electron: desktop builds based on 42.3.1 or 42.3.2, especially packaged apps that handle untrusted binary input.
- NestJS: Fastify adapter routes protected by middleware registered through `MiddlewareConsumer.forRoutes()`.
- http-proxy-middleware: gateways that use `fixRequestBody()` after a body parser has already consumed multipart form data.
- Deno: services using Node TLS compatibility behavior for outbound clients on dual-stack networks.
- Hono: code that accepts user-controlled cookie names before calling `setCookie()`, `serialize()`, or `serializeSigned()`.
- Logs for requests that reached privileged route handlers, upstream services, or worker processes without the expected validation record.
Safe fix path
- Remove untrusted expr-eval `toJSFunction()` use. If the path is required, isolate it from production secrets and customer data.
- Upgrade Electron desktop builds to 42.3.3 and rebuild distributed packages.
- Upgrade NestJS to 11.1.24 or newer and rerun route authorization tests for the Fastify adapter.
- Upgrade http-proxy-middleware to 3.0.7 or 4.1.1 and recheck body-parser and upstream validation behavior.
- Upgrade Deno to 2.7.8 or newer where Node TLS compatibility is used.
- Upgrade Hono to 4.12.12 or newer and reject invalid cookie names before writing headers.
- Preserve proxy, API, and worker logs before rotating tokens or rebuilding containers.
Repair help
Use Ping7 CVE Repair when a public API compiles user expressions, Fastify middleware protects sensitive routes, proxy validation is split from upstream parsing, desktop builds need rebuild review, or logs need review before redeploy.