Node.js Brotli RCE and related open source security fixes

Security traffic on oss-security centered on a Node.js release addressing a high-severity Brotli remote code execution flaw with broad downstream reach. Separate reports covered arbitrary code execution in Godot, data exfiltration in git-annex, and smaller fixes elsewhere in common tooling.

Node.js security release targets high-severity Brotli RCE

An oss-security thread details an upcoming Node.js security release dated 2026/10/21 that fixes a high-severity remote code execution issue in Brotli handling. The flaw reaches many projects that embed or rely on the same compression code, including Git, browsers, and servers. Operators of Node.js runtimes and any Brotli-dependent stacks have a clear reason to track and apply the update once it ships.

Godot 4.x RCE via untrusted .po Plural-Forms headers

A report describes arbitrary code execution in Godot 4.x when loading .po translation files. The loader evaluates the untrusted Plural-Forms header through the Expression system, so a crafted file can run code as soon as a pluralized string is processed. Studios and distributors that accept third-party or user-supplied translations need to treat incoming .po files as untrusted until a fix is in place.

git-annex closes cross-repository data exfiltration

git-annex 10.20261026 fixes CVE-2026-112818, a cross-repository data exfiltration vulnerability. An attacker who controls a special remote can abuse the mechanism to pull data from other repositories. Anyone using git-annex with untrusted or multi-party remotes should move to the updated release.

GNU patch 2.8.1 fixes unsafe reverse-apply file creation

GNU patch 2.8.1 has been released to address CVE-2026-115207. The bug allowed unsafe file creation when a patch was applied in reverse. Build systems and administrators that process untrusted patches should upgrade to avoid unexpected file writes.

OpenPGP packet grammar proposals after gpg.fail retrospective

Authors of the gpg.fail work posted a retrospective that prompted an extended thread on concrete ways to tighten OpenPGP packet grammar. Participants examined hardening steps that would reduce the classes of parser weaknesses previously demonstrated. Maintainers of OpenPGP libraries and tools have practical proposals to evaluate from the discussion.

Airflow SSH provider environment values run as remote shell

CVE-2026-111422 covers shell injection in the Apache Airflow SSH provider. Values supplied through the environment parameter of SSHRemoteJobOperator are executed as shell commands on the remote host. The issue is rated low severity and a fix is available, so Airflow users of the SSH provider should apply the update.