Ulises Gascón
LightNews LightNews
banner
ulisesgascon.com
Ulises Gascón
@ulisesgascon.com
690 followers 280 following 430 posts
#OpenSource Maintainer (@nodejs.org, @expressjs.bsky.social, Lodash, Yeoman...), #TC39 Delegate and #Maker | He/Him
Posts Replies Media Videos
Pinned
ulisesgascon.com
Ulises Gascón @ulisesgascon.com · Nov 11
🌍 Hello, BlueSky! 🤠

I'm Ulises Gascón from Spain! Passionate about #Nodejs, #Express, #JavaScript, and the world of #OpenSource.

I spend my days building, maintaining, and improving tools and libraries for our #devCommunity 🫶

👉 Check out my projects and support my work:
github.com/sponsors/Uli...
Ulises Gascón, smiling widely in a red shirt and headphones, proudly holds up his multi-layered robotic creation. Behind him is a Manhattan map on the wall and shelves filled with tech gadgets and pop culture figures (like 'This is fine' character), reflecting his passion for technology and open-source projects.
Reposted by Ulises Gascón
notwes.bsky.social
What a great pic of us together!!
November 2, 2026 at 2:06 PM
ulisesgascon.com
🚨 Medium-severity security fix in [email protected] just released!

Patches CVE-2026-120216: fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses

github.com/fastify/fast...
fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses
### Impact When `fastify` is configured with a nonzero `handlerTimeout` and a route returns a streaming response, a request whose stream has already transmitted its headers but stays open past the...
github.com
November 2, 2026 at 11:13 AM
ulisesgascon.com
🚨 High-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-117518: @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape

github.com/fastify/fast...
@fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape
### Impact `@fastify/reply-from`'s `buildURL()` validated proxy paths against forward-slash dot-segments only, then resolved the target with the WHATWG `URL` parser, which normalizes backslash and...
github.com
November 2, 2026 at 10:45 AM
ulisesgascon.com
🚨 Medium-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-117531: @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

github.com/fastify/fast...
@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers
### Impact `@fastify/multipart` does not propagate a parser error to the file stream when a multipart request body is malformed. When a request body ends inside a file part with no closing boundar...
github.com
November 2, 2026 at 10:36 AM
ulisesgascon.com
🚨 Medium-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-117549: @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal

github.com/fastify/fast...
@fastify/secure-session vulnerable to signature verification bypass via cookie signature removal
### Impact `@fastify/secure-session` versions `>= 7.5.0, < 8.4.2` accept a session cookie whose signature has been removed when the plugin is configured with `cookie.signed: true`. The plugin call...
github.com
November 2, 2026 at 10:29 AM
ulisesgascon.com
🚨 Low-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-120215: @fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook

github.com/fastify/fast...
@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook
### Impact `@fastify/cors` registered with the non-default `hook: 'onSend'` option crashes on a CORS preflight. On an `OPTIONS` request carrying `Origin` and `Access-Control-Request-Method` header...
github.com
November 2, 2026 at 10:22 AM
ulisesgascon.com
🚨 Critical-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-120213: @fastify/http-proxy vulnerable to prefix escape via decoded route parameters

github.com/fastify/fast...
@fastify/http-proxy vulnerable to prefix escape via decoded route parameters
### Impact `@fastify/http-proxy` substitutes URL-decoded route parameters into `rewritePrefix` without re-encoding them. When an application uses parameterized `prefix` and `rewritePrefix` options...
github.com
November 2, 2026 at 10:17 AM
ulisesgascon.com
🚨 Medium-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-120214: @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments

github.com/fastify/fast...
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
### Impact `@fastify/http-proxy` normalizes literal backslashes before percent-decoding the proxied destination, but it does not normalize backslashes that appear only after decoding. A path using...
github.com
November 2, 2026 at 10:12 AM
ulisesgascon.com
🔖 The latest issue of my #newsletter is live, issue 017.

Covers the @openjsf.org #CNA coordinated break 🏝️ , @nodeconf.eu in Bologna, the week everyone patched everything ( #eMudhra, #php2shell, #node2shell ), 78 CVEs, 17 releases & more 🧯

blog.ulisesgascon.com/newsletter-i...
Newsletter #017: Rest, Bologna, and the Week Everyone Patched Everything 🧯
The OpenJS CNA took a coordinated break and still had a record month, I spent three days in Bologna for NodeConf EU and the Collaborator Summit, and then the web had a rough week with eMudhra, php2she...
blog.ulisesgascon.com
November 1, 2026 at 2:18 PM
ulisesgascon.com
🔒️️️️️ Security update: Check out the October 2026 #Security Releases for #Express

Stay safe out there 🫡

expressjs.com/en/blog/2026...
October 2026 Security Releases · Express.js
Security releases for body-parser and multer have been published. We recommend that all users upgrade as soon as possible.
expressjs.com
October 31, 2026 at 11:13 AM
ulisesgascon.com
🔏 Time to work on Node.js macOS notarization and finally fix the root cause:

github.com/nodejs/node/...
darwin tarball binaries are signed but not notarized · Issue #67140 · nodejs/node
Thanks @sxa for bringing this to my attention. It has been a while since I last touched the macOS notarization, so I went back to it with fresh eyes. Context We have had reports about badly signed ...
github.com
October 30, 2026 at 1:40 PM
ulisesgascon.com
An amazing deep dive into #CVE-2026-111181 (a denial-of-service vulnerability in body-parser) by Gavin Stuart!

expressjs.com/en/blog/2026...
CVE-2026-111181: Denial of service in body-parser · Express.js
A vulnerability in Express body-parser middleware enables a malicious client to crash a server with a single request.
expressjs.com
October 28, 2026 at 8:32 AM
ulisesgascon.com
🚨 Critical-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-112362: @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

github.com/fastify/fast...
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
### Impact `@fastify/express` versions `>= 4.0.5, < 4.0.9`, when Fastify runs with `routerOptions.ignoreDuplicateSlashes: true`, match path-scoped Express middleware against a URL whose duplicate-...
github.com
October 27, 2026 at 11:34 AM
ulisesgascon.com
🚨 Low-severity security fix in @fastify/[email protected] just released!

Patches CVE-2026-117499: @fastify/session vulnerable to session revocation bypass via a logout race condition

github.com/fastify/sess...
@fastify/session vulnerable to session revocation bypass via a logout race condition
### Impact `@fastify/session` documents `Session#destroy()` as removing the session from the store. With the default `rolling: true`, a request that restored a session before a logout can still ...
github.com
October 27, 2026 at 11:22 AM
ulisesgascon.com
Just shipped a new newsletter to Sponsors! 🎁

Covers the OpenJS CNA coordinated break 🏝️ , NodeConf EU in Bologna, the week everyone patched everything (eMudhra, php2shell, node2shell), 78 CVEs, 17 releases & more 🧯

Early access & support my OSS work:
github.com/sponsors/Uli...
Screenshot of the GitHub Sponsors email update for Newsletter #017, "Rest, Bologna, and the Week Everyone Patched Everything 🧯", marked with a green "Published" badge and sent to 7 sponsor tiers. The text opens with "Hola everyone! 🎉" and previews the issue: the OpenJS CNA taking a coordinated break, three days in Bologna without a pager, a rough week for the whole web with a certificate authority with recoverable keys and two nicknamed RCEs, plus 78 CVEs and 17 releases. A note suggests grabbing a coffee and skipping the collapsed lists 🤓. Below, the section "🏝️ We Took a Break. The CVE Flood Did Not." explains the 17 September to 6 October pause, curl's Summer of Bliss as the example, Express joining publicly, and that maintainers owe you nothing. It ends with a dark Grafana dashboard for the OpenJS CNA showing 123 published CVEs, 46 in the last 30 days, and a bar chart of monthly publications peaking in September 2026.
October 25, 2026 at 10:01 PM
ulisesgascon.com
🧑‍💻 Behind every CVE there are humans working hard to release fixes fast, often as volunteers. The fix is the visible part. Triage, testing and coordination are not.

Thanks to #PatchThePlanet for naming them. Proud to be part of it.

patchtheplanet.org/brotli
Brotli vulnerability (CVE-2026-111497) — Patch the Planet
Brotli decoder vulnerability: affected software, fixed releases, and how to disable Brotli decoding while you patch.
patchtheplanet.org
October 24, 2026 at 10:44 AM
ulisesgascon.com
🚨 High-severity security fix in body-parser 2.4.0 and 1.20.9 just released!

Patches CVE-2026-111181: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

github.com/expressjs/bo...
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a de...
github.com
October 22, 2026 at 2:36 PM
ulisesgascon.com
🚨 High-severity security fix in [email protected] just released!

Patches CVE-2026-113872: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

github.com/expressjs/mu...
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
### Impact When `multer` is configured with an asynchronous `fileFilter`, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while an...
github.com
October 22, 2026 at 2:25 PM
ulisesgascon.com
🚀 Just released [email protected] 📦️️️️️️️️️️️️

🍿 #release details: github.com/jshttp/on-fi...
Release 2.4.2 · jshttp/on-finished
Highlights 🔧 Node.js deprecation isFinished(res) now reads writableEnded instead of the deprecated finished property (DEP0136), with a fallback to finished on older Node.js versions. No behavior c...
github.com
October 22, 2026 at 1:22 PM
ulisesgascon.com
[email protected] is out 🎉

🔒️ [email protected] fixes 3 security advisories
⚙️ compileOptions + runtimeOptions to tune handlebars per instance
🧩 Clear error on `settings` render-local collisions
📚 Docs for layouts and template inheritance

Thanks to everyone who contributed!

github.com/pillarjs/hbs...
Release 4.4.0 · pillarjs/hbs
Highlights 🔒 Security Bumped handlebars to 4.7.10, which addresses CVE-2026-106445 (GHSA-p8wg-vrv2-v86f), GHSA-8r5x-fm3f-whwj and GHSA-xw65-4hp5-5hc7. Please upgrade. (#283) ⚙️ Handlebars options...
github.com
October 22, 2026 at 12:33 PM
ulisesgascon.com
🚀 Just released [email protected] 📦️️️️️️️️️️️

🍿 #release details: github.com/expressjs/mu...
Release v2.5.0 · expressjs/multer
Important: Security Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) What's Changed docs: fix typo in .none() and grammar in .any() by @haimingZZ in #1485 fix: don't add a failed upload to the abort cl...
github.com
October 22, 2026 at 11:59 AM
ulisesgascon.com
🚀 Just released [email protected] 📦️️️️️️️️️️

🍿 #release details: github.com/expressjs/bo...
Release 1.20.9 · expressjs/body-parser
Important: Security Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828) What's Changed Release: 1.20.9 by @UlisesGascon in #779 Full Changelog: 1.20.8...1.20.9
github.com
October 22, 2026 at 11:41 AM
ulisesgascon.com
🚀 Just released [email protected] 📦️️️️️️️️️️

🍿 #release details: github.com/expressjs/bo...
Release v2.4.0 · expressjs/body-parser
Important: Security Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828) What's Changed build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #737 chore: group github a...
github.com
October 22, 2026 at 11:40 AM
ulisesgascon.com
🚨 webpack-dev-server shipped a security release fixing 2 CVEs (1 high, 1 medium) in 5.x and 6.x: cross-origin WebSocket access on proxied upgrades, and a Host-validation info leak.

Upgrade to 5.2.7 or 6.1.0.

github.com/webpack/webp...
Release v6.1.0 · webpack/webpack-dev-server
Minor Changes Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @alexander-akait in #5765) Fix client progress modes, socket ...
github.com
October 22, 2026 at 9:46 AM
Reposted by Ulises Gascón
ruyadorno.com
Time to update node 💚
October 21, 2026 at 1:41 PM