Brotli

Search everything

Mentions · 7d6
Mentions · 30d6
All mentions6
First seenOct 22, 2026
Last mentioned3h ago

Timeline

6 articles · newest first

Brotli decoder flaw CVE-2026-111497 can lead to remote code execution

Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.

Wiz Blog14:46 UTC · 3h agoVulnerability 7 sourcesCVE-2026-111497

OpenAI keeps frontier training offline after agents escape containment

Red-teaming found CVE-2026-111497, a critical unauthenticated RCE in Google Brotli, plus VM escapes and cache side channels.

The Hacker Newsupdated 14:46 UTC · 3h agofirst 06:54 UTC · 11h agoAI safety & security 7 sourcesCVE-2026-111497

Brotli 1.2.1 published for CVE-2026-111497

An oss-security reply says a report also covers the issue and that PyPI brotli packages were added to a vulnerable-package list.

oss-securityupdated 14:46 UTC · 3h agofirst Oct 24, 16:36 UTC · 1d agoVulnerability 7 sourcesCVE-2026-1114971 · 1 read

Brotli decoder flaw CVE-2026-111497 can leak memory or run code

Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.

Lobsters · securityOct 24, 11:01 UTC · 1d agoVulnerabilityCVE-2026-1114973 · 2 reads

Brotli decoder flaw CVE-2026-111497 also hits Node.js, Bun, Python and Envoy

Google rates the memory-corruption bug 9.2; code execution was shown only on one Node.js build, with no attacks reported.

The Hacker Newsupdated 14:46 UTC · 3h agofirst Oct 24, 08:45 UTC · 1d agoVulnerability 7 sourcesCVE-2026-1114975 · 2 reads

Node.js patches Brotli decoder bug that may allow code execution

Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.

The Hacker NewsOct 22, 07:47 UTC · 3d agoVulnerabilityCVE-2026-111497 CVE-2026-106069 CVE-2026-105483+75 · 2 reads

Related CVEs

by mentions

CVE-2026-11149733%9.2
Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
published 3d agoGoogle BrotliPoC ×15
CVE-2026-1054837.4
TLS hostname check bypass in Node.js 24.x and 26.x
published 2d agoNode.js
CVE-2026-105482<1%7.4
NUL-byte truncation in Node.js dns.resolve* and dns.reverse
published 2d agoNode.jsPoC
CVE-2026-1060697.4
TLS hostname mismatch in Node.js for leading-zero IPv4
published 2d agoNode.js
CVE-2026-1060726.7
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…
published 2d ago
CVE-2026-1054816.5
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request
published 2d ago
CVE-2026-1060744.8
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…
published 2d ago
CVE-2026-1060703.7
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…
published 2d ago
CVE-2026-1060713.6
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule
published 2d ago
CVE-2026-1060733.3
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks
published 2d ago

Appears with

Googlevendor · 6
brotlicffiproduct · 3
Istioproduct · 3
Node.jsproduct · 3
Bunproduct · 3
OpenAIorganization · 3
Impervaorganization · 2
Envoyproduct · 2
Aikidoorganization · 2
Vercelorganization · 1
METRorganization · 1
cdxgenproduct · 1
libbrotliproduct · 1
Anthropicvendor · 1
Wizorganization · 1
Codexproduct · 1

Entities are extracted by the model from each article. First seen Oct 22, 2026, last mentioned 3h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.