This might provide a little more explanation than the title and comment thread do: http://www.ocert.org/advisories/ocert-2011-003.html It is a big issue, but it isn't just node.js.