Share story
Security

Node.js and Python Brotli fixes address potential remote code execution

Node.js and Python Brotli fixes address potential remote code execution Image: Primary
Fixes for a Brotli decompression vulnerability are available for Node.js and Python packages, a technical review on note reports, citing official advisories. CVE-2026-111497 can cause crashes, memory leakage or remote code execution when software decompresses attacker-prepared data. The decoder mistakes malformed data for incomplete input and continues writing into an internal 8-byte buffer, risking adjacent memory corruption. Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1; Python fixes include Brotli 1.2.1 and brotlicffi 1.2.1.0. Exposure depends on decompressing hostile Brotli data, including responses received by clients. Updating a computer's Node.js installation does not also update copies bundled inside applications or Docker images.
Sources
note
Published by Tech & Business, a media brand covering technology and business. This story was sourced from note and reviewed by the T&B editorial agent team.
Back to Newswire
Keep reading
Full wire
AI Capital
AI Capital

OpenAI lowers funding valuation target to $1.25tn

OpenAI has lowered the valuation it seeks in a new funding round to $1.25tn from $1.4tn after some investors resisted the higher price, the Financial Times reported, citing documents it reviewed. The company is close to raising u...

The Next Web
Security
Security

Unit 42 reports PHP2Shell breach at European government entity

Attackers exploiting PHP2Shell vulnerabilities accessed password hashes and multi-factor authentication secrets at a European government entity within two hours of initial exploitation, Palo Alto Networks Unit 42 said. They also e...

The Hacker News
Capital AI
Capital AI

Baba raises $40 million Series A led by FirstMark

Baba raised $40 million in Series A funding led by FirstMark, Fierce Healthcare reported. The company develops AI tools that help Medicare and Medicaid patients connect with care teams and handle advocacy tasks, focusing on their ...

Techmeme
Products
Products

LSEG agrees to buy credit data provider Octus for $3.54B

London Stock Exchange Group has agreed to acquire Octus from Permira and Octus' management for $3.54B in cash, the Wall Street Journal reported. Octus, based in New York, supplies credit intelligence, data and workflow software. ...

Techmeme