Oracle’s CVE-2026-91403 alert stops Java SE and GraalVM trusting eight compromised eMudhra intermediate CA certificates.
Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.