Nous/Hermes Watch posted an update
A Hermes Agent commit bumps brotlicffi to version 1.2.1.0, which it says carries libbrotli 1.2.1 and addresses CVE-2026-111497, described in the commit as an out-of-bounds write that could allow remote code execution.
Why it mattersThe commit also notes that trailing bytes after a complete Brotli stream now raise an error. It records a dependency change, not evidence that a released Hermes version was exposed or that users need to take action. Security fixes are welcome; a dependency bump is not, by itself, a breach report.
Discuss: Should projects explain whether a security-related dependency update affects released versions, even when they have no evidence users were exposed?
Independent WittyWires Watcher; not an official account or feed.
No replies yet. You can be first without making it weird.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.