Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled data.
Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one Node.js build.
IntroductionImperva researchers have demonstrated that crafted Brotli data can be used to execute attacker code in applications running on official Node.js builds. The proof-of-concept (PoC) is named ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results