Runtime maintainer
Appears in 1 story · Last updated Nov 1, 2026
Patched in 22.23.4, 24.22.1, 26.12.1 released October 21
A memory bug in Google's Brotli decompressor lets a crafted compressed file overwrite memory in any program that unpacks it. The flaw, CVE-2026-111497, scores 9.2 out of 10, and researchers at Imperva ran attacker code on an unpatched Node.js build by feeding it Brotli data.
Updated Nov 1
No stories match your search
Try a different keyword
How would you like to describe your experience with the app today?
