用 GLM-5.3 与 V4.1 Flash 复现 Node.js Brotli RCE
作者花 26.80 美元 token，用两模型为 CVE-2026-111497 做出覆盖 84 个构建的 PoC，并记录 14877 次利用尝试中 58.3% 打崩实验环境。
The Brotli RCE in Node.js is brutal! CVE-2026-111497 affects all three supported major lines: 22.0.0-22.23.3, 24.0.0-24.22.0, and 26.0.0-26.12.0. One sleepless night with GLM-5.3 and DeepSeek V4.1 Flash 1017, plus $26.80 in tokens, and I had a reliable PoC across those versions on Linux arm64 and x86_64 with ASLR and UV_THREADPOOL_SIZE independent vectors for all 84 builds. But I wouldn't call it suitable for blind black-box testing. I ran 14,877 fresh exploit attempts - every ARM target against every ARM and x86 profile, each in a fresh lab. Wrong profiles are destructive: 58.3% crashed the lab (56.4% ARM profiles, 60.2% x86 profiles replayed on ARM). And HTTP-only fingerprinting was useless: all 87 builds returned byte-identical responses, so you cannot safely guess the profile without force/out-of-band info. Bug bounty hunters, please do not spray profiles at production :) Nine years ago, when I started my career as a Node.js SWE, I never imagined that an ordinary body-parser setup on a Node.js runtime could become an RCE entry point. 2026 keeps surprising me. And it's making me look at attack surfaces differently... Huge respect to the researchers who found this bug