eMudhra logins can be bruteforced
eMudhra login systems are vulnerable to brute-force attacks, risking unauthorized access. Users should implement stronger security measures to protect their accounts. (mastodon.catgirl.cloud)
Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)
vercel.com12 points1 comments
A high-severity remote code execution vulnerability (CVE-2026-111497) was found in Node.js’s bundled Brotli decoder: specially crafted Brotli input can trigger an out‑of‑bounds write during decompression, enabling process-memory disclosure and arbitrary code execution with the Node.js process’s privileges. The October 21, 2026 updates for Node.js 22.x, 24.x and 26.x fix this flaw along with nine other issues, including two high‑severity TLS hostname verification bypasses. Applications are exposed when their code or dependent libraries decompress Brotli data controlled by an attacker, whether in incoming request bodies or in fetched responses.
Vercel deployed WAF rules that automatically block known exploit patterns for every project on its network but warns that WAF is not a substitute for applying the runtime patches. Immediate remediation is to upgrade any Node.js outside Vercel’s managed runtimes to 22.23.4, 24.22.1 or 26.12.1, rebuild container images and redeploy, and move projects still on Node 20 to 22.x or 24.x because Node 20 is end‑of‑life. The WAF does not protect responses fetched by functions; operators should also restrict direct access to external backends, review blocked requests in their Firewall dashboard, and follow Node.js security guidance.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
More in Security
How to spot AI science slop
AI-generated science content often contains factual errors and signs like formatting and inhuman mistakes. Recognizing these signs helps verify the accuracy of AI-produced information, especially in scientific contexts. (labmuffin.com)
Utah Woman Speaks Out After Cop Body Slammed Her at Data Center Protest
A Utah woman was forcibly body-slammed by a police officer during a protest against a data center. The incident has sparked outrage and calls for accountability. (commondreams.org)
It's Time to Take Starlink Away from Elon Musk
Paul Krugman argues that Elon Musk's decision to cut off Ukraine's Starlink access was an overreach that compromised U.S. national security and aided Russia. He emphasizes that private individuals should not have the power to make foreign policy decisions, especially during wartime. (paulkrugman.substack.com)
Iceye and Nokia partner with Ukraine to develop satcom capability
Iceye and Nokia are partnering with Ukraine's Ministry of Defence to develop sovereign satellite communication capabilities. The collaboration aims to enhance Ukraine's defense, border security, and disaster response through secure European satellite systems. (iceye.com)
Lawsuits Can't Restrain Big Tech
Lawsuits against tech giants like Alphabet and Meta have resulted in minimal penalties that fail to limit their growing power. Organized efforts for regulation and public control are seen as the only means to effectively restrain these monopolies. (jacobin.com)