A high-severity vulnerability (CVE-2026-111497) in Node.js’s bundled Brotli decoder allows specially crafted Brotli-compressed input to cause an out-of-bounds write, enabling process-memory disclosure and arbitrary code execution under the Node.js process’s privileges. Node.js published security updates on October 21, 2026 for 22.x, 24.x and 26.x (patched to 22.23.4, 24.22.1 and 26.12.1) and fixed nine other issues, including two high-severity TLS hostname-verification bypasses. Any application or library that decompresses attacker-controlled Brotli data - whether from an incoming request or from a fetched response - is exposed on unpatched runtimes. Node.js 20 is end-of-life and does not receive this fix, so projects on 20.x must upgrade to 22.x or 24.x.
Vercel deployed WAF rules the same day to detect and block known exploit patterns for this vulnerability across projects on its network, and is rolling the patched Node.js runtime in managed environments. The WAF reduces exposure for inbound traffic through Vercel but does not replace patching and does not protect fetched responses or self-hosted/back-end Node.js instances. Immediate actions: upgrade any externally run Node.js to the specified patched versions, rebuild container images, change Vercel projects off Node 20.x and redeploy, review blocked requests in the Firewall dashboard, and follow Node.js release guidance or contact [email protected] for questions.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Tech workers in San Francisco face increased risks of espionage, with foreign spies targeting AI companies and employees. Experts warn that romantic or friendly interactions could be attempts at gathering intelligence, making trust difficult in the industry. (sfstandard.com)
Japan's Onamae Desktop Cloud was hacked, impacting up to 27,000 servers. The breach highlights ongoing cybersecurity threats in cloud infrastructure. (bleepingcomputer.com)
Mitmproxy has added a --emudhra option to enhance its functionality. The update involves changes across multiple files, including the changelog and core scripts. (github.com)
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.