<p> The <a href="https://nodejs.org/en"> Node.js project</a> recently had a <a href="https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"> security vulnerability</a> that affected its <a href="https://brotli.org/"> Brotli</a> decoder. The bug <a href="https://project-zero.issues.chromium.org/issues/565308158"> was a buffer overflow</a>, but the particular way that official Node.js binaries are built for Linux meant that one of the main protections against turning a buffer overflow into remote code execution, <a href="https://en.wikipedia.org/wiki/Address_space_layout_randomization"> address space layout randomization</a> (ASLR) could not be turned on. If ASLR had been enabled, the bug would still be exploitable in theory, but much more difficult to exploit in practice. In response, the GNU C Library (glibc) is <a href="https://lwn.net/ml/all/[email protected]/"> considering</a> a new set of <a href="https://sourceware.org/glibc/manual/latest/html_node/Tunables.html"> tunable settings</a> to allow administrators to forbid programs that do not support ASLR. The new settings, while a welcome hardening measure, may not address the root problem. </p>
Continue to LWN.net →You are being forwarded in 6s — stay on this page