MeridianMeridian

Brotli Buffer Overflow Flaw Exposes Node.js to Remote Code Execution and DoS Attacks

A critical buffer overflow vulnerability in Google's Brotli compression library allows remote attackers to corrupt memory, leak data, trigger denial-of-service conditions, or potentially execute arbitrary code. The flaw affects Brotli versions 1.0.3 through 1.2.0 and impacts applications that decompress attacker-supplied Brotli data, including multiple Node.js release lines. The root cause lies in the decoder incorrectly treating an invalid block transition as a temporary need for more input instead of a fatal format error, causing writes beyond an eight-byte internal buffer. Security updates have been released for the library itself as well as for Node.js versions 22, 24, and 26. Organizations are advised to inventory all affected software, containers, and packages and apply the available patches without delay.

Security-InsiderTranslated from German

Read at source

A critical buffer overflow vulnerability in Google's Brotli data-compression algorithm can be exploited by remote attackers to corrupt adjacent memory regions, disclose sensitive information, cause application crashes, or achieve remote code execution.

The issue, tracked as EUVD-2026-108169 / CVE-2026-111497 (CVSS 9.2), resides in the Brotli decoder. When processing a specially crafted compressed stream, the decoder mishandles an invalid block transition and erroneously treats it as a request for additional input data. This leads to writes that exceed the bounds of an internal eight-byte buffer, corrupting neighboring memory.

Brotli is an open-source compression library developed by Google and widely used for web content delivery. The vulnerable code is present in numerous products, most notably Node.js, where applications using the node:zlib module to decompress untrusted Brotli data are exposed. The flaw affects Node.js branches 22.x, 24.x, and 26.x.

Affected versions and patches

  • Brotli library: versions 1.0.3 to 1.2.0
  • Fixed releases: 1.0.10, 1.1.1, 1.2.1
  • Node.js security updates: 22.23.4, 24.22.1, 26.12.1

Administrators should identify all instances of the vulnerable library, including those embedded in containers or third-party packages, and deploy the corrected versions. For operating-system-provided packages, the respective distributor advisories must also be followed.

Node.jsCVE-2026-111497Brotli
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

SonicWall Warns of SonicOS Flaw Allowing SAML MFA Bypass in SSL-VPN
Vulns & Exploits

SonicWall Warns of SonicOS Flaw Allowing SAML MFA Bypass in SSL-VPN

SonicWall has issued a security advisory for a vulnerability in its SonicOS operating system that powers the company's firewalls. The flaw, tracked as CVE-2026-19868, enables attackers who already possess valid SSL-VPN credentials to circumvent SAML authentication controls and the multi-factor authentication enforced by SAML. The company released patches to address the issue and stated it investigated a report indicating possible exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also confirmed active abuse of the vulnerability. No technical details about the attacks or their timeline have been disclosed. SonicWall urges customers to apply the updates immediately due to the associated risks.

Security.NLNov 7, 2026Translated from NL

Microsoft Releases New Windows Paint Version to Address Critical RCE Vulnerability CVE-2026-83844
Vulns & Exploits

Microsoft Releases New Windows Paint Version to Address Critical RCE Vulnerability CVE-2026-83844

Microsoft has issued an updated version of Windows Paint to resolve a serious remote code execution vulnerability identified as CVE-2026-83844. The flaw allows an unauthenticated attacker to execute arbitrary code on vulnerable systems by sending a specially crafted packet, with no user interaction required. The vulnerability was first addressed in a security update on 13 October, but gained wider attention this week after system administrators on Reddit reported difficulties obtaining the patch. The National Cyber Security Centrum (NCSC) warned that successful exploitation could enable attackers to install programs, view data, or fully compromise affected systems. Microsoft now recommends that users upgrade to Windows Paint version 11.2609.401.0 or verify that the version has been installed automatically. The company updated its security bulletin for CVE-2026-83844 yesterday evening to confirm the new release fully mitigates the issue.

Security.NLNov 7, 2026Translated from NL

QNAP Warns Plex Users of Active Plex2Shell Exploitation on NAS Devices
Vulns & Exploits

QNAP Warns Plex Users of Active Plex2Shell Exploitation on NAS Devices

QNAP has issued an urgent advisory to users running Plex Media Server on their NAS systems regarding a set of four vulnerabilities collectively known as Plex2Shell. The flaws allow unauthenticated remote attackers to take full control of vulnerable Plex instances. Plex has confirmed that the vulnerabilities are being actively exploited on a large scale following the public release of proof-of-concept code on 16 October. Compromised servers are being infected with cryptominers and proxy software that enables further malicious activity from the affected systems. QNAP recommends immediate installation of Plex version 1.43.3.10861 or newer through the App Center and advises additional hardening steps for internet-exposed deployments.

Security.NLNov 6, 2026Translated from NL