https://pwn.watch/t/brotli Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 01:02:13 GMT https://pwn.watch/i/nodejs-october-2026-security-releases https://pwn.watch/i/nodejs-october-2026-security-releases Fri, 23 Oct 2026 01:02:13 GMT critical <p>On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a Brotli decoder out-of-bounds write (high per Node.js, CVSS 9.2 critical per the Google CNA on NVD, rooted in Google Brotli 1.0.3 to 1.2.0) that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 22.23.4, 24.22.1, 26.12.1</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too. (<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-111497">source</a>)</li><li>2026-10-22: Researcher Ron Masas says his team reproduced CVE-2026-111497 as a pre-auth RCE on a vulnerable Node.js runtime, with app.use(express.json()) enough to expose a server through a single Brotli request. (<a href="https://x.com/RonMasas/status/2113315979405258810">source</a>)</li><li>2026-10-21: Node.js published the Wednesday security releases and advisory.</li></ul> <p><strong>CVEs:</strong> CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073</p>