Technology
A compression bug hands attackers a Node.js shell
Node.js has patched CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles: a stream that switches block types illegally is read as needing more input, so bytes keep piling into an eight-byte buffer. Applications that decompress attacker-supplied Brotli data, including Express 5 JSON bodies and server-side fetch, are exposed. Node rates the flaw high while the CVE record says 9.2 critical, and Imperva has demonstrated code execution on an official build.