marcosfreitas

Which Node HTTP clients decode Brotli? (CVE-2026-111497)

I did not try to exploit anything. I measured one thing: does the client hand a Brotli response to Node's Brotli decoder? The bug lives in that decoder, so a client that never feeds it attacker-controlled bytes cannot hit the bug through that path. Upgrading Node to 22.23.4 / 24.22.1 / 26.12.1 is still the real fix.

What I measured

1. A local server always answers Content-Encoding: br, with a tiny valid Brotli body. No malformed data.
2. The client asks only for gzip, deflate. A hostile server ignores what you ask for.

marcosfreitas

Coding-agent prompt: find vulnerable Brotli (CVE-2026-111497) in Python Lambda functions, layers and images

Prompt: find vulnerable Brotli in Python Lambda functions (CVE-2026-111497)

Paste this into a coding agent. It asks the agent to write one script, review it, and test it locally before handing it over. Read the script before you run it.

Why Python needs its own check: the bug is in the Brotli C library (google/brotli), not in Node.js. CPython does not ship Brotli. Your function carries it only if a package brings it in: Brotli, brotlicffi, or an extra such as urllib3[brotli], requests with one of those installed, aiohttp, httpx[brotli]. Some packages bundle the C library themselves

marcosfreitas

Coding-agent prompt: check Node.js Lambda functions for CVE-2026-111497 (read-only inventory + probe)

Prompt: check Node.js Lambda functions for CVE-2026-111497

Paste this into a coding agent. Scope and cautions:

• It asks the agent to write two bash scripts, review them, and test them locally before handing them over. Read the scripts before running anything.
• inventory.sh is read-only. probe-runtime.sh creates temporary Lambda functions, so run it only in a non-production account and with a role you have checked.
• Your data stays with you: both scripts run in your own CloudShell, write results only to a local output directory, and send or share nothing anywhere.
• Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

marcosfreitas

const useAuth = (): AuthContextInterface => {
    const context = useContext(AuthContext);
  
    if (!context) {
      throw new Error('useAuth must be used within a AuthProvider');
    }
  
    return context;
  };

marcosfreitas

<?php

    /**
     * Convert a multidimensional array to an object recursively.
     * For any arrays inside another array, the result will be an array of objects.
     *
     * @author Marcos Freitas
     * @param array|any $props
     * @return array|any
     */

marcosfreitas

function PressKeyToContinue() {

    printf "\n";

    question="Pressione S para continuar ou qualquer outra tecla para pular essa parte execução do script";
	expected_key_pressed='s';
	abort_script=false;

	if [ ! -z "$1" ]; then
        question="${1}";

marcosfreitas

<?php
# check for palindrome words
# if the word have almost 1 letter to be changed to be a plindrome, it will be a palíndrome.

function isAlmostPalindrome($word) {
	
	$count_diference = 0;
	$word_reverse = strrev($word);
	
	$word_as_array = str_split($word);

marcosfreitas

<?php

namespace App\Controllers\Site\Ads;

use Silex\Application;
use Symfony\Component\HttpFoundation\Request;
use Silex\Api\ControllerProviderInterface;

class AdsControllerProvider implements ControllerProviderInterface {

marcosfreitas

<title>
<?php

  if(is_home()):
      bloginfo('name');
  elseif( is_category() || is_tag() ):
      single_cat_title(); echo ' &bull; '; bloginfo('name');
  elseif( is_single() || is_page() ):
      single_post_title();
  else:

marcosfreitas

<?php

  /**
	 * Check if a string is a valid based on $formats['input'], then format an output based on $formats['output']
	 * @author Marcos Freitas
	 * @param  string $value The string of the date
	 * @param  array $formats The given input and wanted output formats of the date.
	 * @return  string|boolean
	 */
	public static function getDate($value, $formats){