tldrdailynews.com logo
Tag

Cve 2026 111497

All articles tagged with #cve 2026 111497

PHP Rebuilds Windows Packages to Patch Critical Brotli Decoder Flaw
security1 hour ago

PHP Rebuilds Windows Packages to Patch Critical Brotli Decoder Flaw

PHP released updated Windows packages for versions 8.2 through 8.5 to fix a critical memory corruption flaw in the bundled Brotli library. The update addresses CVE-2026-111497, which allows remote code execution via crafted compressed HTTP responses. Although the PHP version numbers remain unchanged, the new builds include the fixed Brotli 1.2.1 library. Users are advised to download the new packages immediately, as the vulnerability is rated Critical by Google and affects applications using automatic decompression.

via The Hacker News|
#brotli#curl#cve-2026-111497
Brotli Decoder Flaw CVE-2026-111497 Spreads to .NET, FFmpeg, and ClickHouse
cybersecurity1 hour ago

Brotli Decoder Flaw CVE-2026-111497 Spreads to .NET, FFmpeg, and ClickHouse

A critical out-of-bounds write vulnerability in Google’s Brotli decoder, identified as CVE-2026-111497, affects a wide range of software beyond Node.js. The flaw, which allows unauthenticated attackers to corrupt memory or execute code, has been confirmed in .NET, FFmpeg, ClickHouse, Apache Arrow, and Python packages. While Node.js and several other platforms have released patches, some distributions and applications remain unpatched, requiring immediate remediation or temporary workarounds to prevent exploitation.

via CyberSecurityNews|
#brotli-decoder#cve-2026-111497#cybersecurity
Brotli Decoder Flaw CVE-2026-111497 Forces Urgent Updates Across Node.js, Bun, and Envoy
security2 days ago

Brotli Decoder Flaw CVE-2026-111497 Forces Urgent Updates Across Node.js, Bun, and Envoy

A critical vulnerability in the Google Brotli decoder, identified as CVE-2026-111497, allows attackers to corrupt memory and execute remote code by sending crafted compressed data. The flaw affects widely used software including Node.js, Bun, Envoy, and Istio. Fixes are now available for all major affected versions. Organizations unable to patch immediately should disable Brotli decompression for untrusted data to prevent exploitation. The vulnerability impacts any application processing attacker-controlled Brotli-compressed inputs, including HTTP requests, fetched responses, and file processing.

via patchtheplanet.org|
#brotli-decoder#cve-2026-111497#envoy-proxy
Imperva Proves Node2Shell RCE on Official Node.js 24 via Crafted Brotli Data
cybersecurity3 days ago

Imperva Proves Node2Shell RCE on Official Node.js 24 via Crafted Brotli Data

Security researchers at Imperva have demonstrated a remote code execution (RCE) vulnerability, dubbed 'Node2Shell', in the official Node.js 24.22.0 Linux arm64 build. The exploit leverages a flaw in the bundled Brotli decoder (CVE-2026-111497), allowing attackers to execute arbitrary code by sending crafted compressed data. Node.js released a fix on October 21, 2026, and no active exploitation has been reported in the wild as of October 22.

via The Hacker News|
#brotli-decoder#cve-2026-111497#cybersecurity
Node.js Patches Critical Brotli Decoder Flaw and Nine Other Vulnerabilities
security4 days ago

Node.js Patches Critical Brotli Decoder Flaw and Nine Other Vulnerabilities

Node.js released security updates on October 21 for versions 22.x, 24.x, and 26.x, addressing ten vulnerabilities. The most severe is an out-of-bounds write in the bundled Brotli decoder that could allow remote code execution. While a proof-of-concept exploit exists, it has only demonstrated full code execution on weakened test builds, not standard production environments. No active exploitation has been reported in the wild.

via The Hacker News|
#brotli#cve-2026-111497#nodejs
Node.js Patch October 2026 Releases Fix Critical Brotli RCE and Multiple TLS Flaws
technology4 days ago

Node.js Patch October 2026 Releases Fix Critical Brotli RCE and Multiple TLS Flaws

Node.js released security patches on October 21, 2026, for versions 22.x, 24.x, and 26.x to address multiple vulnerabilities. The most critical fix addresses a remote code execution flaw in the Brotli decoder, while other updates resolve high-severity issues in TLS certificate validation and DNS resolution. The release also includes dependency updates for c-ares, ca-cert, OpenSSL, SQLite, and Undici to mitigate public vulnerabilities.

via Node.js Blog: Vulnerability Reports|
#cve-2026-111497#cybersecurity#nodejs