Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution
Node.js has released critical security updates addressing a high-severity flaw in its bundled Brotli decoder that can lead to out-of-bounds memory writes and remote code execution.
The vulnerability, identified as CVE-2026-111497, occurs when a Node.js process decodes attacker-controlled Brotli content, a scenario common in services that accept compressed responses or handle third-party data. This memory corruption issue falls into the category of out-of-bounds writes, where the process writes data beyond allocated buffers, potentially allowing arbitrary code execution under favorable conditions.
The October 21, 2026 security release provides fixes for all currently supported branches. Updated versions include Node.js 22.23.4, 24.22.1, and 26.12.1. Branches 18.x, 20.x, 23.x, and 25.x receive no official patches and require migration to a supported release.
Environments that compile Node.js against a system-provided Brotli library must ensure the dependency incorporates upstream commit 0ed4268 to eliminate residual risk. The same patch batch resolves additional high-severity issues, including hostname validation problems in TLS implementations.
Organizations should inventory services that decode Brotli data, prioritize those accepting untrusted input, and apply updates across production systems, container images, CI runners, and developer workstations to prevent reintroduction of the vulnerability.
Related articles
Mitigating PHP2Shell RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 on Legacy PHP 5.6 Stacks with Varnish, Docker and Apache mod_php
Two critical remote code execution vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) affect PHP before any application code executes, targeting the Zend Engine's longjmp() mechanism during OOM conditions and use-after-free issues with session upload progress. Official patches exist only for supported branches 8.2.35 and newer, leaving PHP 5.6 installations exposed, especially those using Apache with mod_php. An administrator of a high-traffic legacy enterprise application running PHP 5.6 inside Docker containers behind Varnish implemented a four-layer defense without rewriting the monolith. The approach disables session.upload_progress.enabled and sets memory_limit to -1 inside PHP, enforces strict cgroups memory limits and MaxConnectionsPerChild 1 in Apache, adds request-size and cookie-based blocks in Varnish VCL, and forces Connection: close on synthetic error responses. Testing revealed HTTP keep-alive drain issues and differing behavior between direct Apache requests and Varnish-routed traffic. The layered controls successfully neutralize both attack vectors while preserving production stability.
Critical GitLab Flaw CVE-2026-110264 Allows Unauthenticated Remote Code Execution
GitLab has released patches for a maximum-severity vulnerability that permits unauthenticated remote code execution on self-managed installations. The flaw, tracked as CVE-2026-110264 with a CVSS score of 10.0, stems from an integer overflow during regular expression compilation. It affects every version starting from 7.0 released in 2014 and impacts both Community and Enterprise editions. The issue was reported through the company's HackerOne bug bounty program and has no available workaround. Patches are available in multiple recent releases, though earlier critical updates from October 12 do not cover this vulnerability. No exploitation has been observed as of October 22, and the flaw is not yet listed in the NVD or CISA's exploited vulnerabilities catalog.
PHP2Shell Vulnerabilities Targeted in Exploitation Attempts Four Days Before Public Disclosure
Amazon Threat Intelligence detected early exploitation attempts against PHP vulnerabilities on October 17, four days prior to the public disclosure and patch release. The activity was observed through the MadPot honeypot network, with initial requests originating from a commercial anonymization service. Additional probing with varied payloads occurred on October 21, indicating multiple threat actors were involved before fixes became available. OpenAI reported that researchers from the Calif team identified one critical flaw using GPT-5.6 Sol as part of the Patch the Planet initiative, while Wiz independently discovered and reported both issues. PHP developers prepared the patches with support from security researchers and infrastructure providers. Amazon advises organizations to investigate potential compromise traces dating back to at least October 17, as new proof-of-concept exploits appeared within hours of the advisory and were quickly deployed against company sensors.
Anatomy of HTC Sense Vulnerability: Bypassing FRP Lock on HTC U11 Plus Without PC
A detailed technical breakdown reveals how an old HTC U11 Plus running Android 8 or 9 can have its Factory Reset Protection bypassed after a forgotten pattern lock. The method uses the device's own email client and credential storage system to force a new PIN without any PC or external tools. Multiple standard bypass attempts failed due to HTC Sense restrictions, including muscle memory recovery, Google account removal, Find My Device, and bootloader unlocking. The working exploit leverages the Exchange account setup flow to trigger Credential Storage Bypass, which overrides FRP flags by prioritizing certificate requests over setup wizard locks. A combined fingerprint and PIN option then allows creation of a new credential that survives reboot and passes the post-reset Google verification. The technique exploits architectural priority conflicts between the Biometric Framework and FRP enforcement in HTC Sense firmware.