[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIilWtYRgflZ7785eRCwujifLT_MAFUlP52Ee7rF3SSg":3},{"article":4,"iocs":49,"watch_terms":81,"solutions":82,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4e14e6af-12db-4e0f-af91-1c14f85efc4f","Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do","node-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-befor-290013","Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not […]","Node.js released fixes on October 21, 2026 for 10 vulnerabilities across versions 22.x, 24.x, and 26.x, with four rated High severity. The most critical is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder enabling remote code execution. Unlike application dependency vulnerabilities, these flaws exist in the Node.js runtime itself and require runtime upgrades rather than package updates, affecting various deployment scenarios including containers, serverless, and SEAs.","Node.js patches 10 vulnerabilities including critical Brotli RCE flaw CVE-2026-111497","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F10\u002F23\u002Fnode-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-before-attackers-do","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-4-7.png","2026-10-23T12:58:02+00:00","2026-10-23T14:00:08.078272+00:00",9,[17,20,23,25],{"name":18,"type":19},"Node.js","product",{"name":21,"type":22},"Brotli","technology",{"name":24,"type":22},"zlib",{"name":26,"type":27},"Qualys","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[50,54,57,60,63,66,69,72,75,78],{"type":51,"value":52,"context":53},"cve","CVE-2026-111497","Out-of-bounds write in Brotli decoder; remote code execution; High severity",{"type":51,"value":55,"context":56},"CVE-2026-105482","DNS resolution truncation with embedded NUL characters; High severity",{"type":51,"value":58,"context":59},"CVE-2026-105483","TLS hostname validation bypass using fullwidth IP digits; High severity",{"type":51,"value":61,"context":62},"CVE-2026-106069","TLS hostname validation bypass with noncanonical IP addresses; High severity",{"type":51,"value":64,"context":65},"CVE-2026-105481","HTTP keep-alive response handling issue; Medium severity",{"type":51,"value":67,"context":68},"CVE-2026-106072","Improper certificate validation for unusual IPv4 representations; Medium severity",{"type":51,"value":70,"context":71},"CVE-2026-106074","Repeated random values across startup snapshots; Medium severity",{"type":51,"value":73,"context":74},"CVE-2026-106070","ZIP validation exposes attacker-controlled bytes; Low severity",{"type":51,"value":76,"context":77},"CVE-2026-106071","Permission Model filesystem over-grant; Low severity",{"type":51,"value":79,"context":80},"CVE-2026-106073","Permission Model bypass using fs.realpathSync; Low severity",[26,18],{"controls":83,"vendors":165},[84,112,137],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,104],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":98,"vendor_name":26,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":113,"name":114,"problem":115,"products":116},"patch-management","Automated patch management","Known holes get closed in days, not months.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":98,"vendor_name":26,"vendor_logo":99,"product_slug":113,"product_name":134,"url":135,"description":136},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":138,"name":139,"problem":140,"products":141},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[142,150,157],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":152,"url":155,"description":156},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[],{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"nodejs-runtime-rce-flaw-demands-runtime-level-patching-strategy","Node.js Runtime RCE Flaw Demands Runtime-Level Patching Strategy","A critical out-of-bounds write vulnerability (CVE-2026-111497) in Node.js's bundled Brotli decoder enables remote code execution across multiple active Node.js versions, affecting containers, serverless functions, and single executable applications alike. Unlike typical application-layer dependency vulnerabilities, this flaw lives in the runtime itself, meaning standard package manager updates (e.g., npm audit fix) will not remediate it — organizations must upgrade the Node.js runtime directly. This distinction catches many teams off guard because their existing software composition analysis (SCA) tools may not inventory runtime binaries alongside application dependencies. The breadth of affected deployment models amplifies the attack surface, as overlooked container base images or serverless runtimes can remain vulnerable long after a patch is available.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies; the runtime-level nature of this flaw highlights the need for policies that cover infrastructure software beyond application code.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching, and covers all system components including language runtimes processing cardholder data environments.","SI-2 mandates timely identification and correction of information system flaws; applying it to runtime-level software like Node.js would have driven a structured upgrade process immediately upon the October 21 patch release.","A06 explicitly warns that vulnerability scope extends beyond application libraries to include runtimes and frameworks, precisely the gap exploited here when teams rely solely on npm-level dependency scanning.","This control requires organizations to continuously assess and remediate vulnerabilities, including in runtimes and base images — directly addressing the need to identify and patch Node.js before attackers exploit CVE-2026-111497.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, which includes runtime binaries — not just application-layer packages — as demonstrated by this Brotli decoder flaw.","While primarily an access control control, CSF 2.0's Protect function broadly demands that attack surface reduction measures — including keeping runtimes patched — are in place to limit the blast radius of an RCE vulnerability like this one."]