Newsletter #016: Café, CVEs and a Repository Under Attack ☕

Written by Ulises Gascón

Aug 03, 2026 — 9 min read

This post was originally shared with my GitHub Sponsors. If you'd like to get early access to updates like this and support my open source work, consider becoming a sponsor here. 🙌

Hola everyone! 🎉

Hope you've all been doing awesome since our last catch-up. This issue pairs well with a coffee: we launched Café con CVEs, a show about Node.js security in Spanish, I lived through every maintainer's nightmare in a simulated GitHub organization compromise, and I finally wrote down why we reject 95% of the Lodash vulnerability reports. The CVE machine did not slow down either.

Let's dive in! ✨

☕ Arrancamos Café con CVEs

Together with Estefany Aguilar we kicked off Café con CVEs 😎, a NodeSource space where we answer one security question per episode: short, practical conversations in Spanish, zero jargon. The plan is to bring news, attack vectors, and security concepts closer to Node.js and JavaScript developers, and to answer the questions the community sends us.

The first two episodes are already out. Episode 1 covers what a CVE actually is, who assigns these identifiers, and why some records contain so little information.

Episode 2 asks: why can installing an npm package execute code on your machine? We walk through npm lifecycle scripts and what changes with npm v12.

Each episode ships with a companion blog post: episode 1 post and episode 2 post.

We plan to publish one episode per week, and we are using these first chapters to shape the program, so feedback is more than welcome 🙌

🫠 A Working PoC Is Not a Library Vulnerability

Around 95% of the vulnerability reports we receive for Lodash get rejected. Not out of gatekeeping: most reporters are genuinely trying to make the ecosystem safer, and many describe a real problem. The proof of concept runs, something breaks, and we close the report anyway, because the flaw lives in the application, in the JavaScript runtime, or in Lodash's own documented behavior. I finally wrote down how we draw that line: Why Most Lodash Vulnerability Reports Get Rejected.

🔴 Repository Under Attack

Almost a year after we graduated from the GitHub Secure Open Source Fund with Express, the program keeps giving back to many projects. This time I was invited to the first Repository Under Attack Red Team Workshop, run by the GitHub Red Team.

The exercise covers every maintainer's nightmare: a GitHub organization compromise, with you in the middle trying to triage, mitigate, scope, and notify the incident in less than two hours. Even in a simulation, the heart pounds.

Attack chain diagram from the Repository Under Attack workshop, tracing a leaked super admin token through backdoors and workflow abuse to credential-harvesting worms

The attack chain we had to untangle

Thanks to Brad Groux for covering the exercise in detail in The Incident Plan Has to Exist Before the Incident and for sharing the post-mortem from that day, and to the GitHub Red Team for making it so real. I would love to see this kind of training become standard practice for maintainers: if we train on our fears, we become less fearful when a real incident arrives.

🔐 Security Updates

I helped triage and patch 15 CVEs across the ecosystem this period, with undici accounting for five of them and a critical prefix escape in @fastify/http-proxy as the standout.

undici

fast-uri

@fastify/http-proxy

@fastify/reply-from

@fastify/rate-limit

@fastify/static

@fastify/forwarded

body-parser

I wrote up the details on the Express blog, and for the bigger picture, the OpenJS Foundation published its Security Update for Q2 2026. Spoiler: CVE volume exploded this year because of heavy triage of AI-assisted report floods, not a wave of new bugs.

📚 What Else?

The OpenJS CNA API I introduced in the last issue keeps moving forward. At the July Node.js Security Working Group meeting I ran a quick demo for Node.js and we discussed the next steps for the final adoption. Node.js will use the Foundation CNA for CVE operations while keeping HackerOne as the reporting platform, and since the project is modernizing its tooling around security releases, the integration will most likely land there rather than in node-core-utils.

Rafael Gonzaga and others (myself included) are advocating to rethink the Node.js embargo policy. The idea is simple: keep the reporting private, but patch in public, so mitigations land faster and more people can help. We will dig into it at the next Collaboration Summit, and I plan to bring a similar approach to the projects I maintain. Sarah Gooding covered the discussion really well on the Socket blog.

Andrew Nesbitt built Scrutineer for Alpha-Omega: it scans open source projects with AI, but humans verify every finding before it reaches a maintainer. The Security Engineers in Residence (SEIR) community is actively evolving the tool. If you want to anticipate vulnerabilities in your project before someone else finds them, give it a try.

Webpack is now on Bluesky! You can follow the project at @webpack.js.org.

🎖️ Awesome People Doing Awesome Things

Sebastián Beltrán shipped [email protected], his first major release since becoming the repository captain, and it is a serious modernization of one of the foundational packages of the Express stack. The new getRawBodyWeb can read fetch bodies and any WHATWG ReadableStream alongside the classic Node.js streams path, opening the door for body-parser and other implementations in environments where web streams are the preferred choice. The release also moves to ESM-only, replaces iconv-lite with the native TextDecoder, and fails fast when a body exceeds its declared length, among many other things.

The Node.js Web Team shipped the new API docs beta, announced by Guilherme Araújo. The rebuilt docs finally get native search, a design unified with the main site, and many more things. It is the perfect moment to try it and report anything you find, big or small.

Murat Kirazkaya measured Express 4 and 5 across Node.js 18 to 26 in is Express really slow?, and the answer is refreshing. Most of the perceived slowness is the runtime, not the framework. Moving away from older Node.js versions already brings performance improvements.

Matteo Collina wrote No, we can't harden Node.js against prototype pollution, a great reminder that the defense belongs at the application boundary: reject __proto__ at parsing time, reach for Map when the keys are attacker-controlled, and use null-prototype objects for untrusted data.

Paloma Oliveira published About empires, pirates, and the small files that undo power, a reminder that open source is only a tool against power asymmetries when it is intentional. Governance is not paperwork; it is where the power actually lives.

Yesenia Yser wrote Join the Fight: Building a Team of Open Source Security Engineers in Residence, and gave the SEIR initiative something it needed: a clear definition. I sometimes struggle to explain in a single sentence what we do, so thank you, Yesenia, for putting our mission into words:

The Open Source Security Engineers in Residence (SEIR) exists to close the gap between growing security risks and the limited resources available to maintainers. It's a collaborative force designed to make security expertise accessible, actionable, and community-driven. Our mission is to empower open source projects with the knowledge, tools, and support they need to thrive securely in an interconnected world.

The Mocha team donated $20,000 from their Open Collective balance. It is a beautiful reminder that if your project is sitting on resources it does not use, you can always share them with the projects around you. Huge applause for the amazing human quality of the Mocha team.

🔗 Interesting Stuff

Some awesome reads from my network:

🙌 Thank You!

As always, your support as a sponsor makes all of this possible 💖

Whether you're contributing code, giving feedback, or just following along. Thank you!

Stay awesome, Ulises Gascón