Node.js patches 10 flaws across three supported release lines

A vulnerability in the bundled Brotli decoder could allow attackers to execute code on affected systems. Cyber Security News reports that four flaws carry high-severity ratings, with DNS lookups and TLS certificate checks also affected. The Hacker News dates the updates for branches 22.x, 24.x and 26.x to October 21.

• Cyber Security News lists patched versions 26.12.1, 24.22.1 and 22.23.4.

Covered by 3 publishers within 40 hours of the first report.

• RuntimeWire: OpenAI researchers find remote-code flaw in Brotli, prompting runtime patches

Reporting3

THN The Hacker News Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions · info@thehackernews.com (The Hacker News) 3:47 AM

CSN Cyber Security News New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data · Abinaya 10:11 AM

RTW RuntimeWire OpenAI researchers find remote-code flaw in Brotli, prompting runtime patches · Ryan Merket 7:26 PM

Related

SW PHP releases PHP2Shell fixes after companies detect exploit attempts October 21

THN Xint shows OpenAI compaction flaw can expose hidden AI reasoning October 26

FT OpenAI recording suspect Alfozan booked one-way travel to Saudi Arabia October 13

CN METR and Redwood Research uncover flaws in OpenAI monitoring October 22

Topics OpenAI