SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Node.js Bundled Brotli Decoder Flaw Allowed Out-of-Bounds Write (CVE-2026-111497)

0
·7 views

A memory-corruption flaw was found in the Brotli decoder that Node.js bundles inside its node:zlib module. An invalid block switch was mistakenly treated as a temporary need for more input, letting streaming continue into an eight-byte buffer and write beyond its end. The vulnerability, tracked as CVE-2026-111497 and scored 9.2 under CVSS 4.0, could be triggered by crafted Brotli data from an unauthenticated remote attacker. Affected Node.js lines are 26.x, 24.x and 22.x, and fixed builds 26.12.1, 24.22.1 and 22.23.4 were released in the October 2026 security update, which also included dependency updates. The underlying Google Brotli versions 1.0.3 through 1.2.0 are affected, with fixes in 1.0.10, 1.1.1 and 1.2.1.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Checklist for Adding AIoT to Existing Industrial Monitoring Systems

The article advises facilities with existing asset data to first confirm that the data is reliable enough for the specific decision they want to improve, rather than starting with an AI model. It recommends defining one operational use case with a clear owner, such as prioritizing abnormal equipment readings for investigation. Teams should verify that each measurement is tied to the correct device and operating context, and map data flows to find the smallest useful integration. The piece urges starting with decision support rather than automated physical control, which would require separate authorization and safety review. It also stresses judging the pilot on workflow outcomes like missed events and unnecessary alerts, not just model accuracy.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Refactors That Return Copies Can Silently Break Callers Who Rely on In-Place Mutation

A developer argues that characterization tests typically check only return values, missing whether a function alters its arguments in place. Replacing an in-place sort with a sorted copy can keep a test suite passing while production callers continue reading stale data. To catch such changes, the author proposes a Python decorator that snapshots arguments before and after each call and logs any differences to a ledger file. The recommended workflow is to identify candidate mutating functions with grep, wrap them, drive them with recorded real payloads, and commit a stable baseline ledger. The article stresses that the ledger must be deterministic across runs, since run-to-run noise would undermine it as a reliable contract check.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tens of Thousands of Gitea and n8n Instances Exposed Online, Raising Credential Risks

Internet scan data counts roughly 117,500 indexed assets identifying as Gitea and about 420,000 as n8n, both self-hosted tools. The article argues these counts reflect software presence rather than actual secret exposure, since the real risk depends on each instance's configuration. Gitea stores repositories, deploy keys, tokens, and SSH keys, while n8n holds API credentials for connected services within workflow definitions. Key settings include INSTALL_LOCK, SECRET_KEY, and DISABLE_REGISTRATION, and misconfiguration can leave open registration or an unlocked setup page. The author recommends operators verify their version, registration policy, and owner account settings.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI Speeds Up Coding but Slows QA, Raising Technical Debt Costs for Software Teams

Faros AI's Q3 2026 report, covering 22,000 developers, finds that AI-assisted teams deploy more often but face larger pull requests, more unreviewed merges, and a 300% rise in time spent in QA. Monthly incidents have risen 125%, suggesting the cost of AI-accelerated development has shifted downstream to verification and release. GitClear's analysis of 623 million code changes from 2023 to 2026 reports rising duplicated code, more error-hiding patterns, and a 70% decline in refactoring as AI-assisted commits grew. The article argues that teams adopted AI tools faster than the supporting practices needed for quality, such as shared agent instructions, fast tests, and CI checks for common AI mistakes. The author notes that Faros and GitClear are industry studies rather than peer-reviewed research, though DORA findings point in the same direction.

0 comments Read more at DEV Community