Brotli是常見的網頁資料壓縮格式，Node.js內建的解壓縮功能存在CVE-2026-111497漏洞。程式在解壓縮資料時，可能將內容寫入超出預定範圍的記憶體，造成記憶體資料遭破壞，嚴重時可能讓攻擊者遠端執行程式碼。該漏洞影響三個版本分支，但官方尚未詳細說明攻擊所需條件，也未公布遭實際利用的案例。

資安署指出，Node.js廣泛應用於現代網頁前端工具鏈、後端微服務架構與各類API伺服器。這次Node.js共修補10項資安漏洞，其中4項屬高風險等級。最受矚目的CVE-2026-111497漏洞存在於Brotli解碼器中，因邊界外寫入（Out-of-bounds Write）缺陷，攻擊者可藉由惡意構造的請求觸發記憶體損壞，進而達成遠端執行程式碼（RCE）。

資助PHP開發與資安工作的PHP基金會（The PHP Foundation）資安工程師Volker Dusch對《華爾街日報》說，這是PHP十多年來面臨過最嚴重的資安問題，他把它比作2014年迫使全球數十萬台伺服器緊急修補的Heartbleed漏洞。

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Mudhra is exiting global TLS after 8 CA keys, one literally the number 4, proved crackable. What happened, who's affected and ...

Have you ever thought, "It would be convenient if there were a website like this"? Recently, it has become possible to create ...

University of Dubuque plans to rename its business school, which will be housed in a single, centralized location on campus ...

March Madness has grown to 76 teams for the men's and women's tournaments. Both events had been at 68 teams. It's unclear ...

The charges came after the FBI searched Lucas' hometown office in May and a cannabis shop in which she has a stake. At the ...

A Scott County attorney has been appointed to serve as an associate judge for the Iowa judicial district that includes ...

Quiq reports that conversational commerce blends messaging and shopping, allowing real-time interactions for browsing, ...