Sunday, 25 October 2026

Brotli CVE-2026-111497 hits Python, Node.js and Envoy; C++26 standard ballot fails for the first time; cybercriminals are lower-skilled than imagined

Today's Lead

Engineering

Aikido

Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.

CVE-2026-111497 is a critical flaw in the Brotli compression library, with a CVSS v4.0 score of 9.2. The decoder cannot tell malformed input from a request for more data. A crafted stream can force a failed block switch, which writes memory past a buffer. Attackers can use this to leak memory, crash services, or run arbitrary code. Many HTTP clients decode Brotli automatically, so the flaw can reach applications that never import it. Affected packages include Brotli 1.2.0 and earlier, brotlicffi 1.2.0.x, Node.js, Bun, Envoy, and Istio. Patched versions include Brotli 1.2.1, Node.js 22.23.4, and Bun 1.4.4.

Engineering

Lobsters

Balloting has completed for C++26. Unfortunately it was Disapproved

The ballot for C++26 is complete, and the standard was not approved. The P-Member vote was 12 in favor out of 20 (60%), below the required 66.66%. The member body vote had 9 negative votes out of 22 (41%), above the 25% limit. Twelve countries abstained, some because they could not reach a common position. Commenters note that all earlier C++ standards passed unanimously.

Astral

Bringing uv and ty together

Astral released a preview of an experimental integration between uv and ty. ty finds PEP 723 scripts in a project, and uv builds a separate environment for each one. Each script is checked against its own dependencies and Python version. The new uv check command prepares the environment, installs dependencies, and runs ty. Script environment setup is opt-in, because installing dependencies can run third-party code.

Internals for Interns

SIMD and Go

With GOEXPERIMENT=simd, Go 1.27 can generate single instruction, multiple data (SIMD) instructions from normal Go code. The experimental simd/archsimd package maps closely to CPU hardware registers. A benchmark shows the SIMD dot product ran about 9 times faster than a scalar loop.

A. Jesse Jiryu Davis

The Polyglot's Dilemma: Conformance Testing a Dozen Specs in as Many Languages

MongoDB builds about a dozen database drivers, and each driver is written for its own language. The team wrote one shared test suite in YAML, called the Unified Test Format, to check spec conformance across all drivers. Seven drivers replaced their old test runners with one shared runner, which removed about 22,000 lines of code. A bug study using Claude showed fewer conformance bugs in C++, C, Ruby, and PHP after adoption, but more bugs in Node.js. The author concludes that tests must check observable side effects and assert results rigorously, because weak assertions let bugs persist.

Dan Luu

We should be more ambitious with the software we build

Dan Luu argues that AI coding tools make many software projects practical now. He says people still use a pre-agentic cost model, so they skip projects that are now easy. Luu cites Michael Malis's pgrust project, where testing found real Postgres bugs. He says self-checking methods, such as fuzzing, make ambitious work workable. Yossi Kreinin disagrees and argues that most people should be less ambitious.