tl;dr: 4 high severity bugs patched, one is RCE via Brotli. Update to 22.23.4, 24.22.1 or 26.12.1
node root certificate list trusted now-popped signing keys (including the literal number
4); anyone could forge a valid SSL cert that node would have trusted