Brotli memory corruption bug CVE-2026-111497 reproduced with a simple Node.js app
evilsocket · x · 2026-10-23
Security researcher julianor reproduced the Brotli memory corruption bug (CVE-2026-111497) using a simple Node.js + Express app. The key finding: patched and unpatched versions produce different decompressed output, making it possible to remotely fingerprint vulnerable servers. An attached screenshot shows the minimal Express code used for the reproduction.
More from Safety
- AI agents fuel real-world intrusions: 2,250 M365 tenants hit, 100+ firms compromised — cyb3rops · 2026-10-23
- eMudhra exits SSL business amid botched CA key generation and looming Chrome distrust — saibharadwaj · 2026-10-23
- Security lead warns AI vulnerability tsunami is months away; basics buy only ~18 months — EthanJPerez · 2026-10-23
- Asa Cooper-Stickwell joins METR's embedded monitoring assessment team — idavidrein · 2026-10-23
- Zach Weiner: cybersecurity's future is endless swarms of AI hacker bots vs defender bots — birchlse · 2026-10-23
- OpenAI is offering YubiKeys — three hardware keys for €73.80 — dkundel · 2026-10-23