#brotli

14 stories this week · 14 this month · 14 in 6 months · mostly security

Stories per day · 30 days

8 stories, newest first · one card per story

Wiz Blog3h agohigh

Patches cover Node.js 22.23.4, 24.22.1 and 26.12.1; Wiz says 91% of cloud environments have vulnerable resources.

The poster says distros using Node.js --shared-brotli should avoid statically linked copies of the affected code.

Versions 1.0.3 through 1.2.0 are affected; fixed releases include Brotli 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1.

Perl module versions from 0.004001 before 0.023 ship a brotli library whose decoder can write out of bounds (CVE-2026-115936).

Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.

GBHackers3d agohigh

Fixed builds are 26.12.1, 24.22.1, and 22.23.4; the advisory gives no evidence of active exploitation.

Patched builds are 26.12.1, 24.22.1 and 22.23.4; four of the ten issues are high severity.

Fixes include a Brotli out-of-bounds write that can allow remote code execution, plus TLS hostname bypasses.

Stories tagged #brotli