Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)

Posted by khaled_ismaeel 3 hours ago

Counter8Comment1OpenOriginal

Comments

Comment by sippeangelo 1 hour ago

From what I can gather, Express 5's body-parser has Brotli decoding enabled by default which would make any endpoint with this middleware vulnerable to this. Am I mistaken?