Tag

Node.js

Search filters, alert rules, routing configs and log tools all end up accepting regular expressions from users. In a backtracking engine that is a …

Oct 31, 2026 · 10 min read

Most upload bugs come from trusting something the client sent: the filename, the Content-Type, or the idea that a file sitting in a public folder …

Oct 30, 2026 · 9 min read

A 100 KB gzip body can decompress to 100 MB. Node's maxOutputLength stops that in the one-shot zlib functions, but streams silently ignore it, and …

Oct 29, 2026 · 7 min read

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, now on CISA's KEV list. It ships inside Node.js, Python packages, Go modules, …

Oct 28, 2026 · 8 min read