Heist/ feed

Security feed

patchSecurity fix · Unratedoss-security

CVE-2026-115936: IO::Compress::Brotli out-of-bounds write in decoder

IO::Compress::Brotli bundles a vulnerable Brotli decoder that can be reached when decompressing untrusted data. Upgrade to version 0.023 or later; upgrading the system Brotli library does not remediate the issue.

Announced

IO::Compress::Brotli · Fixed in 0.023CVE-2026-115936CVE-2026-111497
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Upgrade to IO-Compress-Brotli 0.023 or later.

IO::Compress::Brotli

IO::Compress::Brotli versions from 0.004001 before 0.023
Affected versions
from 0.004001 before 0.023
Versions: from 0.004001 before 0.023
Fixed versions
0.023
Upgrade to IO-Compress-Brotli 0.023 or later.
Prerequisites
Any caller that decompresses untrusted data with unbro or the decompress method
Any caller that decompresses untrusted data with unbro or the decompress method reaches the bundled decoder.
Related CVEs
CVE-2026-115936
CVE ID: CVE-2026-115936
CVE-2026-111497
described in CVE-2026-111497

Publisher severity

No explicit severity was extracted.

Event
#19310 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · Unratedoss-security

Brotli release v1.2.1

Google Brotli published a library release addressing a vulnerability that also affects consumers of the library.

Announced

Google brotli · Fixed in v1.2.1CVE-2026-111497
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.

Google brotli

underlying problem is not restricted to Node.js alone, but rather in Google brotli
Affected versions
Not stated in this extraction
Fixed versions
v1.2.1
https://github.com/google/brotli/releases/tag/v1.2.1 has been published for the library itself.
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2026-111497
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)

Publisher severity

No explicit severity was extracted.

Event
#19308 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement