[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWT_tIJQvJCyXWJ14VaBq2ih6TWXHb77f5IVZzJwAkww":3},{"article":4,"iocs":41,"watch_terms":64,"solutions":65,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"37bd374e-087f-4c12-be65-38a4099c67f2","Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","node-js-brotli-decoder-bug-could-allow-remote-code-execution-in-all-supported-ve-4681e1","Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code of their choosing on the affected system. Each supported line has one fixed version:","Node.js released security patches on October 21 for versions 22.x, 24.x, and 26.x addressing 10 vulnerabilities, with the critical issue being an out-of-bounds write in the bundled Brotli decompression library (CVE-2026-111497) that could enable remote code execution. The flaw affects any application decompressing Brotli data from untrusted sources, including automatic decompression via fetch() calls. While the project rates it high severity and describes RCE potential, a public proof-of-concept demonstrated only crashes and limited memory reads on standard builds, with no wild exploitation reported as of October 22.","Node.js Brotli decoder out-of-bounds write flaw allows RCE in all supported versions","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fnodejs-brotli-decoder-bug-could-allow.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgFwR_FE94PTthun36oXfrSIiYx7N-Hb3Ww1w2gFs6x6qs0mML2v_TmYZmgqYKxB6VlMBzmIQksNdHldgX-UxykDBNwnszmBuB7IZWyWJhxei65NJlOImUWde5tYzB7D94dmieFBGhFNVAt3bL4qlhXkl4o3uw362QKgJpk37xutyRmM5bB3sHR8XMC3bc\u002Fs1600\u002Fnodejs-rce.jpg","2026-10-22T07:47:22+00:00","2026-10-22T12:00:03.100679+00:00",9,[17,20,22],{"name":18,"type":19},"Node.js","product",{"name":21,"type":19},"Brotli",{"name":23,"type":24},"Google","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[42,46,49,52,55,58,61],{"type":43,"value":44,"context":45},"cve","CVE-2026-111497","Out-of-bounds write in Brotli decoder; remote code execution risk",{"type":43,"value":47,"context":48},"CVE-2026-106069","TLS hostname-check bypass via non-canonical IP form",{"type":43,"value":50,"context":51},"CVE-2026-105483","TLS hostname-check bypass with fullwidth digit IP addresses",{"type":43,"value":53,"context":54},"CVE-2026-105482","dns.resolve truncates hostnames containing null bytes",{"type":43,"value":56,"context":57},"CVE-2026-105481","Keep-alive socket processes responses before requests sent",{"type":43,"value":59,"context":60},"CVE-2026-106072","Certificate validation bypass for non-canonical IPv4 addresses",{"type":43,"value":62,"context":63},"CVE-2026-106074","randomUUID() and randomInt() return predictable values in startup snapshots",[23,18,21],{"controls":66,"vendors":147},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,105,113],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":97,"product_name":102,"url":103,"description":104},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":122,"name":123,"problem":124,"products":125},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[126,134,139],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":135,"product_name":136,"url":137,"description":138},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[148],{"slug":149,"name":23,"logo_path":150,"roles":151},"google","\u002Fvendor-logos\u002Fgoogle.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"critical-nodejs-brotli-rce-bug-highlights-bundled-library-risk","Critical Node.js Brotli RCE Bug Highlights Bundled Library Risk","An out-of-bounds write vulnerability in Node.js's bundled Brotli decompression library (CVE-2026-111497) exposes all supported Node.js versions to potential remote code execution when handling untrusted compressed data, including via automatic fetch() decompression. The root issue is that a third-party library embedded directly within the Node.js runtime was not patched promptly, meaning every application built on the platform inherited the flaw without any individual developer action. This matters because developers often assume the runtime itself is secure, creating a blind spot for vulnerabilities residing in bundled dependencies. The broad attack surface — any app decompressing Brotli from external sources — means the exposure is widespread across the Node.js ecosystem.",[158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"PCI DSS Requirement 6":167,"NIST SP 800-53 SI-2: Flaw Remediation":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies, meaning operators of Node.js-based critical services must have processes to act swiftly on high-severity CVEs like this one.","Requirement 6 mandates protecting systems and software against known vulnerabilities through a risk-based patching programme, which would require organisations processing payments via Node.js to apply this critical patch within defined SLAs.","SI-2 mandates identifying, reporting, and correcting information system flaws on defined timescales — a formal flaw remediation process would have ensured the bundled Brotli library patch was applied rapidly across all Node.js deployments.","This category directly addresses the risk of using components — including runtime-bundled libraries like Brotli — with known vulnerabilities, and prescribes maintaining an inventory and applying patches promptly.","Continuous vulnerability management requires tracking CVEs against all software including runtimes; applying the Node.js patch within its release window directly addresses this flaw before exploitation occurs.","A.8.8 requires organisations to obtain timely information about technical vulnerabilities in systems they use and take appropriate action, covering exactly this scenario of a critical CVE in a bundled runtime component.","While primarily an access control control, limiting which services can accept and decompress Brotli-encoded data from untrusted external sources reduces the exploitable attack surface for this RCE vulnerability."]