NodeJS and Java are in a similar place (this CVE is a memory safety issue in PHP's C-language interpreter) but Go's compiler/runtime is written in Go and is memory-safe all the way down to the assembly.

▲

minitech 3 hours ago | parent | next [-]

Much of Node’s standard library is written in JavaScript, which can’t go on to exploit V8 vulnerabilities even given similar types of bugs, so I wouldn’t say it’s in a similar place. Not as familiar with Java, but I expect PHP is in a class of its own here.

▲

aussieguy1234 2 hours ago | parent | prev [-]

Looks like we now have a similar release happening for NodeJS

https://nodejs.org/en/blog/vulnerability/october-2026-securi...

	▲	minitech 2 hours ago \| parent [-]
		Blog post from a week ago with no “CRITICAL”, any reason to expect it not to look like the last one (https://nodejs.org/en/blog/vulnerability/july-2026-security-...)?