Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution (Bill Toulas/BleepingComputer)
A critical flaw dubbed ‘HTTP2Shell’ in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
We haven't written up this one. Techmeme has the full story — the link below goes straight to it.