Brotli是常見的網頁資料壓縮格式，Node.js內建的解壓縮功能存在CVE-2026-111497漏洞。程式在解壓縮資料時，可能將內容寫入超出預定範圍的記憶體，造成記憶體資料遭破壞，嚴重時可能讓攻擊者遠端執行程式碼。該漏洞影響三個版本分支，但官方尚未詳細說明攻擊所需條件，也未公布遭實際利用的案例。

資安署指出，Node.js廣泛應用於現代網頁前端工具鏈、後端微服務架構與各類API伺服器。這次Node.js共修補10項資安漏洞，其中4項屬高風險等級。最受矚目的CVE-2026-111497漏洞存在於Brotli解碼器中，因邊界外寫入（Out-of-bounds Write）缺陷，攻擊者可藉由惡意構造的請求觸發記憶體損壞，進而達成遠端執行程式碼（RCE）。

資助PHP開發與資安工作的PHP基金會（The PHP Foundation）資安工程師Volker Dusch對《華爾街日報》說，這是PHP十多年來面臨過最嚴重的資安問題，他把它比作2014年迫使全球數十萬台伺服器緊急修補的Heartbleed漏洞。

（中央社記者楊堯茹台北22日電）程式語言PHP存在重大安全漏洞，資安署今天表示，已啟動緊急應變機制，並成立專案小組應處；台灣約有2萬8000個對外網站使用PHP，政府機關約有200個網站，但實際受到影響數量會更少，而無法修補漏洞情況下，才會建議將網站下架。

New releases for Node.js 22.x, 24.x and 26.x fix high-severity vulnerabilities and protect against compromised eMudhra ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Have you ever thought, "It would be convenient if there were a website like this"? Recently, it has become possible to create ...

First responders and a Maryland State Police Aviation Command helicopter are working in the area of Jackson Mountain to rescue a victim hanging from a tree-stand, according to ...

Tourists and locals gathered at a temple in southern Egypt on Thursday to witness a rare solar phenomenon. Twice a year, the sun illuminates the statues of Ramesses II and ...

A team lead who said his company had struggled to fill a vacancy for months claimed he was rejected within six minutes after ...

The giveaway will be held at 1 p.m. Sunday, Oct. 25, at Greater Faith Church, 12805 Seippel Road, according to an online ...

The Congressional Budget Office estimated that the legislation President Donald Trump called the “One Big Beautiful Bill” ...