OpenAI-disclosed Node.js Brotli flaw (CVE-2026-111497): a paste-ready Claude Code audit prompt
alex_verem · x · 2026-10-26
OpenAI this week disclosed a Brotli compression flaw in the Node.js ecosystem (CVE-2026-111497) that could let attackers take over apps without a password. The post shares a paste-ready Claude Code prompt that audits your project and builds a one-page HTML report: every place your app or its packages use Node.js, Bun, Envoy or Brotli with versions; whether each is on a fixed version (Node 22.23.4/24.22.1/26.12.1+, Bun 1.4.4); every spot unpacking compressed data; and the exact update commands in order. The prompt instructs the model to verify fixed versions at patchtheplanet.org/brotli, change nothing without approval, and note the deployment target. Screenshot shows it running in Claude Opus 5.5 High.
More from coding & agent
- Imagination Studio: rebuilt local open-source platform for video, audio, music and image generation — Scobleizer · 2026-10-26
- Traks: free MIT-licensed self-hosted analytics on Cloudflare with an MCP server for agents — moeinteractive · 2026-10-26
- AI adoption up to 78% but developer trust down to 33%, Stack Overflow surveys show — agh_murad · 2026-10-26
- Arize's Aparna Dhinakaran on the AI engineer's new job: running factories of agents — AI Engineer · 2026-10-26
- Open-source AI design skills for Claude Code and Cursor earn 5.1k stars — moeinteractive · 2026-10-26
- RExBench: best coding agent solves only 33% of autonomous research extension tasks — najoungkim · 2026-10-26