eMudhra, Brotli, and the Long Tail of a Security Fix

How much software do you have to update to fix one vulnerability, let alone two far-reaching ones in the same week? Our corner of the internet was getting impatient waiting for Node’s eMudhra fix to drop. The certificate block had merged , and we were ready to update Node, rebuild, and move on. Then the October 21 release dropped , and we got Brotli too. That covered both problems in Node. But how much else used that same decoder? It was tucked into other applications and…