100

CVE-2026-111497 (Broccoli2Shell, aka Node2Shell): an out-of-bounds write in Google's Brotli decoder affecting Node.js, Python Brotli/brotlicffi and anything built on the C decoder. Affected versions, how to check, and how to fix it.

top 14 comments
sorted by: hot top new old
[-] pipe01@programming.dev 39 points 5 days ago

Installing the update isn't enough. A running process keeps the old decoder until it restarts

Yes, that's kinda how computers work?

[-] SirHaxalot@nord.pub 25 points 5 days ago

Imo still worth reminding people that just because you run an apt/dnf upgrade running applications still map the now unlinked outdated version.

[-] bhamlin@lemmy.world 2 points 4 days ago

So you're saying that Windows' insistence on restarting for every little thing is a security feature?

[-] dan@upvote.au 11 points 4 days ago* (last edited 4 days ago)

Different philosophies.

On Linux, you can delete a running application and it's fine, because files aren't actually deleted until the last process that has it open closes it. This applies for all files, not just executables.

Internally, files are mainly identified by an inode rather than the file path. If you delete a file then create a new one with the same name, the new file will have a different inode number to the old file. Anything that had the file open will still have a valid reference to the old file. If you're running a program and upgrade it while it's running, the currently running version will still be using the old inode, while any new instances will use the new one.

Windows doesn't do that. On Windows, the file path is the main identifier for the file. Files that are in use and executables that are running are locked and can't be modified. It tells you to restart so that it can swap in the new files after closing everything. When updating a program, you just need to close it to be able to update, but OS files need reboots because they're locked the whole time the OS is running.

Note that some versions of Windows don't require that any more. Some editions of Windows Server 2025 support hotpatching. This patches code (both OS code and program code) directly in memory, avoiding the need to restart to apply the update. On Linux, there's a proprietary system called Kernelcare that does the same thing for kernel patches.

[-] bhamlin@lemmy.world 0 points 3 days ago

Woosh, but good response. 🫠

[-] dan@upvote.au 2 points 3 days ago

How's it a whoosh? I thought their question was genuine.

[-] bhamlin@lemmy.world 1 points 2 days ago

It was me, and the question wasn't genuine. I was joking that maybe there was a hidden security purpose to windows reboots.

[-] darklamer@feddit.org 8 points 4 days ago

Yes, that's kinda how computers work?

No, it's only the most common way. There are also lots of systems where it's perfectly possible, even normal, to upgrade running processes in-place without restarting.

[-] Randelung@lemmy.world 2 points 3 days ago

I'm still impressed by Erlang and their hot swappable code mechanics. This isn't really relevant to library updates, but still!

[-] lnxtx@sopuli.xyz 8 points 5 days ago

Sure, but good reminder anyway.

[-] UltraBlack@lemmy.world 30 points 5 days ago
[-] lnxtx@sopuli.xyz 19 points 5 days ago
[-] Appoxo@lemmy.dbzer0.com 2 points 4 days ago

So that was the reason I saw the packages during an apt run...

[-] dan@upvote.au 6 points 5 days ago* (last edited 5 days ago)

For Nginx on Debian, I need to figure out if just updating the libbrotli1 package is sufficient, or if libnginx-mod-http-brotli needs to be updated too. I suspect it's dynamically linked (since that's standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.

this post was submitted on 26 Oct 2026
100 points (99.0% liked)

Technology

89269 readers
5661 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 3 years ago
MODERATORS