Proof assistant kernel bugs and Node.js Brotli fix

Reports on oss-security detailed several kernel soundness failures in the Rocq and Lean 4 proof assistants, each permitting closed proofs of False. A Node.js security release was also announced for a high-severity flaw in the shared Brotli decoder library.

Rocq guard checker accepts non-terminating fixpoint

A soundness issue tracked as CVE-2026-72703 lets the Rocq guard checker accept a non-terminating mutual fixpoint through unchecked cross-calls. The defect yields a closed proof of False, demonstrated by deriving 0 = 1. Users of Rocq for formal verification must treat the kernel as temporarily unsound until patched.

Lean 4 nested inductive projections forge proofs

CVE-2026-72844 describes a Lean 4 kernel soundness bug that permits forging proofs via nested inductive projections. The report demonstrates construction of a proof of False without axioms. Formal developments relying on Lean 4 kernel checking are affected until a fix lands.

Rocq guard checker accepts higher-order fixpoint argument

Under CVE-2026-72705 the Rocq guard checker accepts a fixpoint passed as a higher-order argument, again allowing an unchecked proof of False from otherwise valid definitions. This is another independent kernel defect in the same system. Verification workflows that trust Rocq's termination checking need to reassess recent developments.

Node.js security release for Brotli decoder flaw

Node.js maintainers announced an upcoming security release that discloses CVE-2026-111497, a high-severity defect in the Brotli decoder originating in the shared Google library. The same code is used by many other projects, broadening the impact beyond Node.js itself. Operators should prepare to update runtimes and any dependent packages that embed the library.

Unfixed Rocq Print Assumptions universe omission

CVE-2020-37268, still open since 2020, concerns Rocq/Coq Print Assumptions omitting unsafe universe checking that was inlined through Parameter Inline. The omission lets universe inconsistencies go undetected and can hide proofs of False. Long-lived formal libraries that rely on the command for axiom audits remain exposed.

Rocq universe state desynchronised after module close

CVE-2026-72714 is a zero-day Rocq soundness bug in which the universe checking flag is not restored on module close. The resulting desynchronisation permits proofs of False without axioms. Projects that load and close modules dynamically should isolate untrusted developments until a repair is available.

Rocq guard checker trusts corrupted recursive tree

An initial report under CVE-2026-72704 states that the Rocq kernel guard checker can trust a corrupted recursive tree after transport, again enabling a proof of False. The issue is marked as a zero-day. Kernel-level trust assumptions in Rocq are further eroded by this additional defect.

Lean 4 inference cache poisoning via opaque declarations

CVE-2026-72711 reports a Lean 4 kernel soundness bug that poisons the inference cache through opaque declarations, allowing a proof of False. This is a separate cache-bypass path from the nested-projection issue. Lean 4 users should treat recent kernel-checked theorems with caution pending fixes.