--- title: Issue #808: Rebuilding the original GTA engine in... description: Node.js v26.12.1, v24.22.1 and v22.23.4 patch ten CVEs, including the 'Node2Shell' Brotli decoder flaw that can lead to remote code execution. Bun 1.4.4 adds a... canonical: https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Issue #808: Rebuilding the original GTA engine in JavaScript — JavaScript Weekly | daily.dev og:description: Node.js v26.12.1, v24.22.1 and v22.23.4 patch ten CVEs, including the 'Node2Shell' Brotli decoder flaw that can lead to remote code execution. Bun 1.4.4 adds a... og:url: https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl og:image: https://api.daily.dev/og/posts/p8twL0wyl.png og:image:alt: Issue #808: Rebuilding the original GTA engine in JavaScript — JavaScript Weekly og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Issue #808: Rebuilding the original GTA engine in JavaScript — JavaScript Weekly **[JavaScript Weekly](https://daily.dev/sources/jswkly)** · 4 min read · 2 upvotes · 0 comments ## Summary Node.js v26.12.1, v24.22.1 and v22.23.4 patch ten CVEs, including the 'Node2Shell' Brotli decoder flaw that can lead to remote code execution. Bun 1.4.4 adds a Prettier-compatible 'bun fmt' formatter. Electron 45 upgrades to Chromium 156, Node 24.22 and V8 15.6 and adds Prompt API hooks. TanStack introduces Redact, a smaller React runtime reimplementation claiming 20-70% smaller client builds but synchronous-only rendering. Biome 2.6 adds Markdown, YAML and SCSS formatting support. Sentry gave $1m to open source maintainers this year, including pnpm, TanStack, MSW and Knip contributors. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Node2Shell vulnerability in Node.js and should I update immediately? Node2Shell is a flaw in the Brotli decoder (tracked as CVE-2026-111497) that can lead to remote code execution when an application decompresses malicious data. It's fixed in Node.js v26.12.1, v24.22.1 (LTS) and v22.23.4, among ten CVEs patched in those releases. Exploit traffic for this flaw has already been observed in the wild, and since the bug originates in Google's Brotli library, bundled copies elsewhere also need patching. _Developers tracking urgent CVE patches like Node2Shell can follow fast-moving security releases on daily.dev._ ### What does Bun's new bun fmt command do in Bun 1.4.4? Bun 1.4.4 adds 'bun fmt', a Prettier-compatible code formatter built into Bun that can use an existing Prettier or oxfmt configuration file, so teams don't need to change their formatting setup to adopt it. It's noted as being very fast compared to running Prettier directly. _Anyone weighing Bun's built-in tooling against Prettier can keep up with releases like this on daily.dev._ ### What is TanStack Redact and how much smaller does it make React builds? TanStack Redact is a build plugin that swaps out React and React DOM for a smaller reimplementation that runs in the browser without requiring code changes. It works with Vite, Start, Vinext and Next.js. TanStack reports client builds 20 to 70% smaller, though rendering with Redact is synchronous only, unlike React's concurrent rendering. _Developers deciding whether a slimmer React runtime fits their build can track tools like TanStack Redact on daily.dev._ ## Similar posts on daily.dev - [Issue \#794: npm 12, TypeScript 7, and Bun in Rust — JavaScript Weekly](https://daily.dev/posts/issue-794-npm-12-typescript-7-and-bun-in-rust-javascript-weekly-83kbt2vgr) · JavaScript Weekly · 3 upvotes · 0 comments - [JavaScript Weekly Issue 784: May 5, 2026](https://daily.dev/posts/javascript-weekly-issue-784-may-5-2026-j1cxi1z0c) · JavaScript Weekly · 3 upvotes · 0 comments - [Node Weekly Issue 624: May 14, 2026](https://daily.dev/posts/node-weekly-issue-624-may-14-2026-gtg587gyk) · Node Weekly · 9 upvotes · 0 comments - [Friday Links \#42: The Best JavaScript News This Week](https://daily.dev/posts/friday-links-42-the-best-javascript-news-this-week-luwj2l7sq) · JS Dev Space · 13 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#react](https://daily.dev/tags/react), [#nodejs](https://daily.dev/tags/nodejs), [#bun](https://daily.dev/tags/bun) [View this post on daily.dev](https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Issue #808: Rebuilding the original GTA engine in JavaScript — JavaScript Weekly","url":"https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl"},"datePublished":"2026-10-27T15:18:49.747Z","dateModified":"2026-10-27T15:30:48.309Z","description":"Node.js v26.12.1, v24.22.1 and v22.23.4 patch ten CVEs, including the 'Node2Shell' Brotli decoder flaw that can lead to remote code execution. Bun 1.4.4 adds a...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"JavaScript Weekly","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JavaScript Weekly","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/864c660ddc284525a1d4c36e837e61d9","url":"https://daily.dev/sources/jswkly"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,react,nodejs,bun","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JavaScript Weekly","item":"https://daily.dev/sources/jswkly"},{"@type":"ListItem","position":3,"name":"Issue #808: Rebuilding the original GTA engine in JavaScript — JavaScript Weekly"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/issue-808-rebuilding-the-original-gta-engine-in-javascript-javascript-weekly-p8twl0wyl#faq","mainEntity":[{"@type":"Question","name":"What is the Node2Shell vulnerability in Node.js and should I update immediately?","acceptedAnswer":{"@type":"Answer","text":"Node2Shell is a flaw in the Brotli decoder (tracked as CVE-2026-111497) that can lead to remote code execution when an application decompresses malicious data. It's fixed in Node.js v26.12.1, v24.22.1 (LTS) and v22.23.4, among ten CVEs patched in those releases. Exploit traffic for this flaw has already been observed in the wild, and since the bug originates in Google's Brotli library, bundled copies elsewhere also need patching. Developers tracking urgent CVE patches like Node2Shell can follow fast-moving security releases on daily.dev."}},{"@type":"Question","name":"What does Bun's new bun fmt command do in Bun 1.4.4?","acceptedAnswer":{"@type":"Answer","text":"Bun 1.4.4 adds 'bun fmt', a Prettier-compatible code formatter built into Bun that can use an existing Prettier or oxfmt configuration file, so teams don't need to change their formatting setup to adopt it. It's noted as being very fast compared to running Prettier directly. Anyone weighing Bun's built-in tooling against Prettier can keep up with releases like this on daily.dev."}},{"@type":"Question","name":"What is TanStack Redact and how much smaller does it make React builds?","acceptedAnswer":{"@type":"Answer","text":"TanStack Redact is a build plugin that swaps out React and React DOM for a smaller reimplementation that runs in the browser without requiring code changes. It works with Vite, Start, Vinext and Next.js. TanStack reports client builds 20 to 70% smaller, though rendering with Redact is synchronous only, unlike React's concurrent rendering. Developers deciding whether a slimmer React runtime fits their build can track tools like TanStack Redact on daily.dev."}}]} ```