tldrdailynews.com logo
Tag

Brotli Decoder

All articles tagged with #brotli decoder

Brotli Decoder Flaw CVE-2026-111497 Spreads to .NET, FFmpeg, and ClickHouse
cybersecurity1 hour ago

Brotli Decoder Flaw CVE-2026-111497 Spreads to .NET, FFmpeg, and ClickHouse

A critical out-of-bounds write vulnerability in Google’s Brotli decoder, identified as CVE-2026-111497, affects a wide range of software beyond Node.js. The flaw, which allows unauthenticated attackers to corrupt memory or execute code, has been confirmed in .NET, FFmpeg, ClickHouse, Apache Arrow, and Python packages. While Node.js and several other platforms have released patches, some distributions and applications remain unpatched, requiring immediate remediation or temporary workarounds to prevent exploitation.

via CyberSecurityNews|
#brotli-decoder#cve-2026-111497#cybersecurity
Brotli Decoder Flaw CVE-2026-111497 Forces Urgent Updates Across Node.js, Bun, and Envoy
security2 days ago

Brotli Decoder Flaw CVE-2026-111497 Forces Urgent Updates Across Node.js, Bun, and Envoy

A critical vulnerability in the Google Brotli decoder, identified as CVE-2026-111497, allows attackers to corrupt memory and execute remote code by sending crafted compressed data. The flaw affects widely used software including Node.js, Bun, Envoy, and Istio. Fixes are now available for all major affected versions. Organizations unable to patch immediately should disable Brotli decompression for untrusted data to prevent exploitation. The vulnerability impacts any application processing attacker-controlled Brotli-compressed inputs, including HTTP requests, fetched responses, and file processing.

via patchtheplanet.org|
#brotli-decoder#cve-2026-111497#envoy-proxy
Imperva Proves Node2Shell RCE on Official Node.js 24 via Crafted Brotli Data
cybersecurity3 days ago

Imperva Proves Node2Shell RCE on Official Node.js 24 via Crafted Brotli Data

Security researchers at Imperva have demonstrated a remote code execution (RCE) vulnerability, dubbed 'Node2Shell', in the official Node.js 24.22.0 Linux arm64 build. The exploit leverages a flaw in the bundled Brotli decoder (CVE-2026-111497), allowing attackers to execute arbitrary code by sending crafted compressed data. Node.js released a fix on October 21, 2026, and no active exploitation has been reported in the wild as of October 22.

via The Hacker News|
#brotli-decoder#cve-2026-111497#cybersecurity