Subscribe free
Morning Merge · Saturday, October 24, 20267 min read

Lambda runs your Express app; patch Brotli

Also: a Laravel auth bypass, a body-parser crash, Kimi K3.1 Pro and live profiling for Workers.

The main thing

An orange pump sits in a fitted cradle, drawing water through branching inlet pipes and pouring a continuous stream into an open trough, in an isometric engineering blueprint.

You might be running an Express or Hono app on Lambda inside an adapter that never quite fit. You can take the adapter off. AWS now runs a standard Node.js server that listens on a port on Lambda, with no changes.

Lambda Web Functions accept Express, Hono, Fastify, Next.js or any Node.js framework. You deploy with one command and get back an HTTPS endpoint. One warm execution environment serves many requests at once, which cuts cold starts. Responses can stream, so server-side rendering and token-by-token LLM output work without a separate hosting layer.

Billing changes too. You pay for active CPU time and memory, and you do not pay for CPU time spent waiting on a database or an API. That suits I/O-heavy backends. The catch is that memory is billed for the whole life of the execution environment.

Reactions are mostly warm. One commenter notes that many workloads can now skip API Gateway, then names the real gotcha: with many requests in one environment, "you might need to be sync/mutex aware." Module-level state that was safe when one invocation meant one request is now shared. Google Cloud Run and Azure Container Apps already offer the same model, with no adapter and configurable concurrency.

What to do today: nothing urgent. If you run Node.js behind a Lambda adapter in one of those five Regions, try moving one service. First, look for global mutable state that assumes one request at a time.

Quick bits

Brotli bug allows remote code execution: OpenAI found an unauthenticated RCE in Brotli, the compression library inside Node.js, Bun and Envoy. A malicious client can take over a server that accepts compressed input. A malicious server can take over a client that accepts it, such as curl --compressed.
- The code fix landed in Brotli in February, but no release followed at the time. OpenAI says Brotli has since cut new releases and published a CVE; Bun's advisory tracks it as CVE-2026-111497.
- OpenAI says Node.js has released, or is releasing, security updates.
- One HN commenter says it looks like brotli 1.2.0 and earlier are vulnerable. The Python package is fixed in brotli==1.2.1.
- What to do: take the security update from each runtime or library that bundles the C Brotli library, such as Bun 1.4.4. Not every build is affected: a commenter notes the Rust brotli crate is not a binding to the C library. Until you can update, a commenter suggests turning off br content-encoding on both sides. (discussion)

Cloudflare Workers get production flamegraphs: since October 9, you can take on-demand CPU or heap-allocation profiles of a live Worker, or of one named Durable Object, from the dashboard or the cf CLI. Profiles download for pprof. Each capture covers a short window, so the target needs traffic while it runs. Turn on source maps for TypeScript. Cloudflare used it to find leftover Prometheus code; removing it cut a Worker's p99.9 memory from 133 MB to 118 MB, back under the 128 MB limit.

Kimi K3.1 Pro lands on the API: Moonshot's model has a 1-million-token context window and is on the Kimi API now. Moonshot promises the weights by Nov 4. A Highspeed version runs 2-3× faster at twice the price, not counting cache hits. Moonshot reports 65.7% on Terminal-Bench 4.0, just behind Claude Opus 5.5 at 66.4%. HN commenters doubt that benchmark scores match their own testing. (discussion)

Laravel TokenGuard auth bypass (CVE-2026-114509, critical): this affects apps that use the built-in token API guard on some MySQL or MariaDB setups. An attacker can send a crafted non-string credential and log in as any existing user.
- Affected: laravel/framework 13.0.0 up to, not including, 13.29.0, and all versions before 12.68.0.
- Upgrade to laravel/framework:13.29.0 or laravel/framework:12.68.0.

One request can crash body-parser (CVE-2026-111181): this affects apps on default options. A compressed body followed by trailing bytes throws an uncaught exception that stops the process. Parsing runs before routing, so no auth or matching route is needed.
- Affected: 2.0.0 up to, not including, 2.4.0, and all versions before 1.20.9.
- Upgrade to body-parser@2.4.0 or body-parser@1.20.9. If you never accept compressed bodies, you can instead pass inflate: false.

OpenSSL 4.1.0 is a feature release. It adds DTLS 1.3, RFC 8701 GREASE and DTLS in the listener API. It drops Windows-on-Itanium and Windows CE, and commenters gave Itanium a salute. Four known DTLS issues ship with it, so read that list before you turn on DTLS 1.3. (discussion)

GitHub Apps on enterprises are now GA: new permissions cover enterprise rulesets, 2FA requirements, IP allowlists and member privileges, so more automation can stop using classic PATs. GitHub Enterprise Server gets it in 3.24.

Cloudflare frees 100 TB of RAM: probability math showed that pingora-ketama could use about 90% fewer hashes per backend and still balance load. Ring entries also shrank from 8 bytes to 6. Cloudflare rolled the new ring out gradually so it would not empty caches across the network.

Also happening

Patch roundup

Today's score: one adapter you can delete and a dozen packages to bump. You've earned the second coffee.

← All issues

Get this in your inbox every morning.

Free. Five minutes. Unsubscribe in one click.

Subscribe free →