Node.js Brotli Decoder Flaw Enables Remote Code Execution, Patches Issued
Node.js released security updates on October 21 fixing a remote code execution vulnerability in the bundled Brotli decompression library, which researchers later demonstrated and which Microsoft and others then patched.
5newsrooms
7articles
5.5 daysrunning
Oct 22first seen
Ask Scout
Scout answers questions about this story using only the coverage below.
Coverage over time
Articles
| Oct 27, 11:45 AM | techradar.com | Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites |
| Oct 26, 3:08 PM | thenextweb.com | Microsoft ships emergency .NET fixes for a critical Brotli flaw |
| Oct 26, 10:58 AM | theregister.com | Microsoft releases emergency .NET security fixes for Google Brotli bug |
| Oct 26, 10:45 AM | thehackernews.com | PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw |
| Oct 26, 9:45 AM | techmeme.com | Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution (Bill Toulas/BleepingComputer) |
| Oct 23, 12:50 AM | thehackernews.com | Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data |
| Oct 22, 12:47 AM | thehackernews.com | Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions |