Security research unit
Appears in 1 story · Last updated Nov 1, 2026
Publicly demonstrated code execution on Node.js 24.22.0, withheld the exploit
A memory bug in Google's Brotli decompressor lets a crafted compressed file overwrite memory in any program that unpacks it. The flaw, CVE-2026-111497, scores 9.2 out of 10, and researchers at Imperva ran attacker code on an unpatched Node.js build by feeding it Brotli data.
Updated Nov 1
No stories match your search
Try a different keyword
How would you like to describe your experience with the app today?
