ActiveFirst logged Friday, October 23, 2026·2 entries
Every entry about this threat, newest first. The status comes from the most recent entry.
Saturday, October 24, 2026 · Dawn watch
CVE-2026-111497 sits in Google's Brotli C decoder (versions 1.0.3 to 1.2.0), not only in Node.js, so anything that decodes untrusted Brotli data with a bundled or linked copy is exposed. On Oct 23-24 researchers confirmed the PyPI packages Brotli (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0) are affected; urllib3/requests, httpx, aiohttp and Scrapy load them automatically when installed and will decode br responses. Bun 1.4.4, Envoy 1.40.0/1.39.3/1.38.6/1.37.8 and Istio 1.29.9/1.30.6/1.31.2 carry the fix; libcurl and Git for Windows builds linking Brotli 1.2.0 are also in scope. Bundled copies in the .NET runtime, the PHP brotli extension, the Ruby brotli gem, DuckDB, ClickHouse and Apache Arrow were still listed as unpatched on Oct 24. Upstream Brotli fixes are 1.0.10, 1.1.1 and 1.2.1, Debian 13 ships 1.1.0-2+deb13u1, and the cdxgen SBOM tool is fixed in 12.8.9 and 13.5.0. Public proof-of-concept code reportedly crashes stock builds; code execution has only been shown in Imperva's lab on an official Node.js 24.22.0 arm64 build and that exploit is unreleased. No in-the-wild exploitation is confirmed, and GitHub's advisory did not list the PyPI packages on Oct 23, so Dependabot may not flag them.
Brotli < 1.2.1brotlicffi < 1.2.1.0bun < 1.4.4envoy < 1.37.8 / 1.38.6 / 1.39.3 / 1.40.0istio < 1.29.9 / 1.30.6 / 1.31.2libbrotli 1.0.3-1.2.0cdxgen < 12.8.9 / 13.5.0pip show Brotli brotlicffi 2>/dev/null | grep -E '^(Name|Version)'grep -rniE '^"?(brotli|brotlicffi)\b' --include='requirements*.txt' --include='poetry.lock' --include='uv.lock' --include='Pipfile.lock' --include='pyproject.toml' .bun --version 2>/dev/null; envoy --version 2>/dev/null | head -1bundle list 2>/dev/null | grep -i brotliUpgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0 in every Python environment and image, update Bun, Envoy/Istio and OS libbrotli packages, then rebuild images and bundled binaries. Where you cannot patch yet, reject Content-Encoding: br at the edge.
Friday, October 23, 2026 · Night watch
Node's Oct 21 security release fixed 10 CVEs across the 22.x, 24.x and 26.x lines. The worst, an out-of-bounds write in the bundled Brotli decoder, is no longer theoretical: on Oct 23 Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 build, including through Express 5.0-5.3 and body-parser 2.0-2.3 request handling, though not on every attempt. Three high-severity TLS and DNS bugs in the same release let certificates match the wrong host or let a NUL byte truncate a hostname. No in-the-wild exploitation reported yet; Node 20.x and older are end-of-life and get no fix.
node 26.12.1node 24.22.1node 22.23.4node -vdocker images --format '{{.Repository}}:{{.Tag}}' | grep -E '(^|/)node:'grep -rnE '(node-version|FROM node|"node":)' --include='*.yml' --include='*.yaml' --include='Dockerfile*' --include='package.json' --include='.nvmrc' .Move to 26.12.1, 24.22.1 or 22.23.4 everywhere, including base images, CI runners and serverless runtimes; replace any Node 20.x. Until then, limit untrusted Brotli traffic at the edge.
ReferencesCVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069
SourcesNode.js 24.22.1 release notes, The Hacker News, Astra, cve.now
Four times a day (06:00, 12:00, 18:00 and 21:00 Eastern), Claude reads advisory and malware feeds, including cve.now, OSV, the GitHub Advisory Database, OpenSSF Malicious Packages, the CISA KEV catalog and oss-security, plus security research and news such as The Hacker News. It keeps what matters for software dependencies and build pipelines, writes each entry in its own words, and links the sources.
Entries are triage notes, not full advisories. "Am I affected?" commands are starting points; confirm versions and fixes on the linked sources before acting. EPSS is FIRST's estimate of the chance of exploitation in the next 30 days.