OpenAI's Codex Security finds Node2Shell RCE bug; EoL Node 20/23/25 get no fix
basedjensen · x · 2026-10-23
Following PHP2Shell, OpenAI's Codex Security team disclosed Node2Shell, a critical bug allowing arbitrary code execution in Node.js apps, successfully demonstrated on the official Node.js 24.22.0 image. Node 20, 23, and 25 are all end-of-life and will receive no fix. One developer questioned whether roughly 60% of the worldwide production fleet still runs Node 20, leaving many deployments exposed without patches.
Related event: Node.js Ships Security Updates Across 22/24/26 Lines Fixing Brotli RCE(10 posts)→
More from coding & agent
- Kolab Benchmark Uses Pro Screen Recordings to Show AI Agents Overestimate Collaboration Quality — minnesotanlp · 2026-10-27
- Dev argues Claude burns far more tokens than GPT models for the same coding work — haider1 · 2026-10-27
- Stop building agents that can't change models: stable contracts, external state, real evals — rseroter · 2026-10-27
- Cheap models can cost more in agent harnesses than frontier ones, researcher warns — vasuman · 2026-10-27
- Kanzo: A 5k-Line Rust Kanban Binary With MCP for Claude Code and Codex — allmudi · 2026-10-27
- 'A human approves everything' is a trap: approval fatigue and how to actually design safe agents — Efistoffeles · 2026-10-27