--- title: Issue #645: A Brotli flaw affecting Node is being... description: Node.js 26 'Lithium' is now the active LTS release, with support through April 2029. Node 24 has moved into maintenance mode and Node 22 stays in maintenance... canonical: https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Issue #645: A Brotli flaw affecting Node is being exploited — Node Weekly | daily.dev og:description: Node.js 26 'Lithium' is now the active LTS release, with support through April 2029. Node 24 has moved into maintenance mode and Node 22 stays in maintenance... og:url: https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1 og:image: https://api.daily.dev/og/posts/ShIn7Ikf1.png og:image:alt: Issue #645: A Brotli flaw affecting Node is being exploited — Node Weekly og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Issue #645: A Brotli flaw affecting Node is being exploited — Node Weekly **[Node Weekly](https://daily.dev/sources/ndwkly)** · 3 min read · 0 upvotes · 1 comments ## Summary Node.js 26 'Lithium' is now the active LTS release, with support through April 2029. Node 24 has moved into maintenance mode and Node 22 stays in maintenance until April 2027. Node 27's first alpha is being prepared under the new annual release schedule. Deno's team is working on getting Deno into a foundation, and the field of major server-side runtimes could narrow to Node, Bun and workerd. OpenTelemetry JS 3.0 ships dual ESM/CommonJS builds and merges its Node, web and base SDKs into one package. Chokidar 6.0, Verdaccio 7.0, AVA 8.2 and path-to-regexp 9.0 also shipped updates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Node.js version is the current active LTS release? Node.js 26, codenamed 'Lithium', became the active LTS release with Node.js 26.13.0, receiving updates through April 2029. Node 24 has moved into maintenance mode, and Node 22 remains in maintenance until April 2027, making Node 26 the line to target for new production deployments. _Teams planning an LTS upgrade can track Node's release timeline shifts on daily.dev._ ### Is Deno being discontinued? Deno's runtime is set to wind down after its team moved to Cloudflare. This could narrow the field of major server-side JavaScript runtimes down to Node, Bun and workerd. Separately, Deno's team says it is working on getting Deno into a foundation, and an initial community fork called Ende has appeared. _Developers weighing runtime choices can follow how the Deno situation unfolds on daily.dev._ ### What changed in OpenTelemetry JS 3.0? OpenTelemetry JavaScript SDK 3.0 now ships dual ESM/CommonJS builds with strict 'exports' maps, which means deep imports from the package will break. It also merges the separate Node, web and base trace SDKs into a single unified package, simplifying dependency management for instrumented applications. _Teams upgrading observability tooling can check breaking changes like these on daily.dev before updating._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > node/bun/workerd narrowing down tracks with what I'm seeing too, deno's value prop keeps getting absorbed straight into node (permissions, native ts) which makes switching runtimes a harder sell every release. ## Similar posts on daily.dev - [Node Weekly Issue 624: May 14, 2026](https://daily.dev/posts/node-weekly-issue-624-may-14-2026-gtg587gyk) · Node Weekly · 9 upvotes · 0 comments - [Node.js Moves to One Major Release Per Year, Starting with Node 27](https://daily.dev/posts/node-js-moves-to-one-major-release-per-year-starting-with-node-27-kyuqjazoc) · InfoQ · 0 upvotes · 0 comments - [JavaScript Weekly Issue 784: May 5, 2026](https://daily.dev/posts/javascript-weekly-issue-784-may-5-2026-j1cxi1z0c) · JavaScript Weekly · 3 upvotes · 0 comments - [Node.js — Node.js 26.0.0 \(Current\)](https://daily.dev/posts/node-js-node-js-26-0-0-current--xsccfs0nf) · Node.js · 98 upvotes · 0 comments --- Tags: [#nodejs](https://daily.dev/tags/nodejs), [#npm](https://daily.dev/tags/npm), [#opentelemetry](https://daily.dev/tags/opentelemetry), [#deno](https://daily.dev/tags/deno) [View this post on daily.dev](https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Issue #645: A Brotli flaw affecting Node is being exploited — Node Weekly","url":"https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1"},"datePublished":"2026-10-29T10:54:37.188Z","dateModified":"2026-10-29T10:55:03.689Z","description":"Node.js 26 'Lithium' is now the active LTS release, with support through April 2029. Node 24 has moved into maintenance mode and Node 22 stays in maintenance...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Node Weekly","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Node Weekly","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/d9a53a9e9f1147e9ba5a36452cc68fad","url":"https://daily.dev/sources/ndwkly"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"nodejs,npm,opentelemetry,deno","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Node Weekly","item":"https://daily.dev/sources/ndwkly"},{"@type":"ListItem","position":3,"name":"Issue #645: A Brotli flaw affecting Node is being exploited — Node Weekly"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1","comment":[{"@type":"Comment","text":"node/bun/workerd narrowing down tracks with what I’m seeing too, deno’s value prop keeps getting absorbed straight into node (permissions, native ts) which makes switching runtimes a harder sell every release.","datePublished":"2026-10-31T18:18:18.909Z","url":"https://daily.dev/posts/ShIn7Ikf1#c-e07JEaEG8","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/issue-645-a-brotli-flaw-affecting-node-is-being-exploited-node-weekly-shin7ikf1#faq","mainEntity":[{"@type":"Question","name":"Which Node.js version is the current active LTS release?","acceptedAnswer":{"@type":"Answer","text":"Node.js 26, codenamed 'Lithium', became the active LTS release with Node.js 26.13.0, receiving updates through April 2029. Node 24 has moved into maintenance mode, and Node 22 remains in maintenance until April 2027, making Node 26 the line to target for new production deployments. Teams planning an LTS upgrade can track Node's release timeline shifts on daily.dev."}},{"@type":"Question","name":"Is Deno being discontinued?","acceptedAnswer":{"@type":"Answer","text":"Deno's runtime is set to wind down after its team moved to Cloudflare. This could narrow the field of major server-side JavaScript runtimes down to Node, Bun and workerd. Separately, Deno's team says it is working on getting Deno into a foundation, and an initial community fork called Ende has appeared. Developers weighing runtime choices can follow how the Deno situation unfolds on daily.dev."}},{"@type":"Question","name":"What changed in OpenTelemetry JS 3.0?","acceptedAnswer":{"@type":"Answer","text":"OpenTelemetry JavaScript SDK 3.0 now ships dual ESM/CommonJS builds with strict 'exports' maps, which means deep imports from the package will break. It also merges the separate Node, web and base trace SDKs into a single unified package, simplifying dependency management for instrumented applications. Teams upgrading observability tooling can check breaking changes like these on daily.dev before updating."}}]} ```