Posts
Node2Shell: when decompression corrupts the process
How CVE-2026-111497 turns a Brotli decoder error into memory corruption, which Node.js applications are exposed, and how to patch them.
- How TypeScript 7.1 checks embedded codeContent mappers give TypeScript virtual code to check, but source positions and permission to execute the mapper determine how useful and safe that check is.
- HTTP compression spends CPU to save bytesFollow HTTP content negotiation, then measure where gzip, Brotli and zstd trade encoding time for fewer response bytes.
- What breaks when you upgrade to OpenCode v2Understand how OpenCode v2's shared service changes session routing, plugin and client contracts, and the permission behavior you need to check during migration.
