CVE-2026-105482

你，是一个普普通通平平无奇的运维 今天中午你刚休息完，拿着一杯咖啡坐回了自己的工位上 想象一下你司架构是 nginx(CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629) 反向代理，后面挂着 PHP 8.1(CVE-2026-109618, CVE-2026-109619) 主站、Node.js 24.x(CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074) Brotli 网关、Go(CVE-2026-111943) 微服务、Rust TLS 校验层(RUSTSEC-2026-0382, CVE-2026-111943) 、Python + LiteLLM 1.107.0 AI 中台，全部跑在 Linux 内核 c6e50df8 之前，HTTPS 证书由 eMudhra 签发并通过 emSign 交叉认证，根证书库用 Go(CVE-2026-111943) crypto/x509 + Rust(RUSTSEC-2026-0382, CVE-2026-111943) webpki-roots + Python certifi，CI 昨晚刚从 PyPI(LiteLLM 1.107.0被投毒) 拉了新包 而你，是这个网站的唯一运维

few hours ago @nodejs fixed 3 high-severity bugs. each hides behind something your server does every day brotli (CVE-2026-111497) > crafted compressed data makes node's decoder write outside its memory, and code can run on your server > you're concerned if you fetch urls someone else picked (webhooks, link previews, crawlers, agents) or accept compressed request bodies. fetch(), axios and got unpack replies on their own tls (CVE-2026-106069, -105483) > write an ip oddly (10.5 for 10.0.0.5) and node can accept a certificate issued for another address > you're concerned if your services call each other by ip over https dns (CVE-2026-105482) > dns.resolve() stops at the first null character. http://evil.com\http://0.trusted.com passes an "ends with .trusted.com" check, and http://evil.com gets looked up > you're concerned if you call dns.resolve() yourself to vet a domain

Notable high-severity issues CVE-2026-111497 — Brotli decoder out-of-bounds write that can allow remote code execution (affects 22.x/24.x/26.x). TLS certificate hostname verification bypasses (CVE-2026-105483 and CVE-2026-106069). DNS name truncation involving NUL characters in dns.resolve (CVE-2026-105482).

Thrilled to see my recent vulnerability research featured on @TheHackersNews! The October @nodejs Security Release patched 3 of my reported CVEs, including two High-severity flaws: 🔹 CVE-2026-105482 (High) 🔹 CVE-2026-105483 (High) 🔹 CVE-2026-105481 (Medium) 🛡️ Read the details here:https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html #CyberSecurity #BugBounty #Nodejs #CVE #InfoSec

Node.js からもセキュリティアップデートが公開されました。 1. CVE-2026-111497（Brotli デコーダーの境界外書き込み）2. CVE-2026-105482（dns.resolve の NUL 文字切り詰め問題） 3. CVE-2026-105483 / CVE-2026-106069（TLS 証明書のホスト名検証バイパス）、とりまバッチ終了。#Nodejs #脆弱性