Node.js and Go Release Same-Day Emergency Security Updates: Brotli Decompression Can Lead to RCE; Go Blocks Compromised Intermediate Certificates

On October 22, the Administration for Cyber Security (ACS), MODA urged public and private sectors to accelerate patching: Node.js patched 10 vulnerabilities—including 4 high-severity flaws—among which CVE-2026-111497 is an out-of-bounds write in Brotli decoding that may lead to remote code execution, fixed in versions 22.23.4, 24.22.1, and 26.12.1 ^[1]. Go released versions 1.27.3 and 1.26.10 to blocklist 8 intermediate certificates from an Indian certificate authority whose private keys were compromised, requiring existing Go applications to be recompiled and redeployed ^[1].

Organisations running: Node.js Node.js, Go Go

Go released versions 1.27.3 and 1.26.10 to blocklist 8 intermediate certificates from an Indian certificate authority with compromised private keys; existing Go applications must be recompiled and redeployed ^[1].