[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:node2shell-node-js-brotli-decoder-rce-cve-2026-111497":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","rapid-alert","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","Marcus Lenngren","2026-10-23T16:42:51.248+00:00","![Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOn 21 October 2026, Node.js released security updates for its three supported lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is CVE-2026-111497, an out-of-bounds write in the Brotli decompression code that Node.js bundles. The project describes the outcome as remote code execution.\n\nThe flaw is in code Node.js ships, not in your own program. Node runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression. A crafted Brotli stream can make the decoder continue past a block transition the stream's own structure made impossible, carry on with an invalid internal state, and write past its buffer.\n\nOn 22 October, Imperva researcher Ron Masas published an analysis naming the flaw Node2Shell. Imperva said its proof of concept ran attacker-supplied code in applications using the official Node.js 24.22.0 Linux arm64 image, without a debugger or a custom build. It reported that patched Node.js 24.22.1 rejected the same inputs, that execution took multiple attempts, and that it tested only Linux arm64 builds and its own configurations. No exploitation in the wild has been reported as of 23 October.\n\nNode.js rates the Brotli flaw high rather than critical, and no CVSS scores have been published for any of the 10 issues.\n\n## Timeline\n\n- Feb 2026: the fix was first made in Brotli's source.\n- 21 Oct: Node.js ships 22.23.4, 24.22.1 and 26.12.1, fixing 10 flaws and adding the eMudhra block. Brotli 1.2.1, 1.1.1 and 1.0.10 ship the same fix.\n- 22 Oct: Imperva publishes the Node2Shell analysis with a working PoC against 24.22.0.\n- 22 Oct: no exploitation in the wild reported.\n\n## Am I affected?\n\nYou are exposed if a Node.js service decodes Brotli data from outside its trust boundary. Two paths matter:\n\n- A response consumed by Node's built-in fetch() when the remote server sends Content-Encoding: br.\n- A request body decoded by Express 5.0.0 to 5.3.0 or body-parser 2.0.0 to 2.3.0.\n\nImperva notes that a bare Node.js HTTP server does not decode incoming Brotli bodies on its own, so request-side exposure depends on middleware being configured to decompress them.\n\nThe vulnerable code lives in the runtime, so a package inventory will miss it. Check the Node version inside container images, single-executable applications (SEAs), version managers such as nvm, bundled runtimes and serverless functions such as AWS Lambda. Node.js 25.x, 23.x, 21.x, 20.x and earlier have no fix and must be moved to a supported line.\n\n## What to do now\n\n1. Upgrade to the fixed release for your line: 22.23.4, 24.22.1 or 26.12.1. Any later release in the same line also includes the fix.\n2. If you run 26.x, upgrade to 26.12.1 before it becomes LTS on 28 October.\n3. Move any runtime on 25.x, 23.x, 21.x, 20.x or earlier to a supported line. There is no fix for those.\n4. Rebuild and redistribute SEAs and snapshot-based apps with a patched runtime.\n5. Rebuild container images on the patched version and redeploy running containers.\n6. While updates roll out, limit untrusted Brotli traffic on affected paths. Note that firewall or WAF rules do not cover Brotli responses your application fetches from other servers, and do not replace upgrading.\n\n## How to hunt\n\n- Run `node -v` on every host and compare against the fixed versions.\n- Find runtimes outside standard paths: `find \u002F -name node -type f 2>\u002Fdev\u002Fnull`.\n- List services that decode Brotli: look for fetch() usage, and for Express 5 or body-parser with decompression enabled.\n- Inspect running containers and images for the bundled Node version, not just the package manifest.\n- Check for distributed SEAs and snapshots that embed an old runtime.\n\n## What does not help\n\n- Updating npm dependencies. The vulnerable code is in the Node.js runtime, not in application packages, so dependency checks will not surface it.\n- WAF or firewall rules alone. Vercel added rules on 21 October that block the attack in inbound requests, but these do not cover Brotli responses fetched from other servers and do not replace the upgrade. There is no workaround within Node itself.\n\n## Sources\n\n- [Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fnodejs-brotli-decoder-bug-could-allow.html), The Hacker News, 22 Oct\n- [Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do](https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F10\u002F23\u002Fnode-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-before-attackers-do), Qualys Threat Research, 23 Oct\n- [Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept](https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fnodejs-october-2026-security-releases-cve-2026-111497.html), Cyber Kendra, 22 Oct\n- [After PHP and eMudhra, Here Comes Node.js](https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fafter-php-and-emudhra-here-comes-node-js\u002F), Checkmarx Zero, 22 Oct\n- [Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fresearchers-demonstrate-node2shell-rce.html), The Hacker News, 23 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,45],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",{"slug":37,"kind":38,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":44},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":46,"kind":6,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":18},"arista-patches-third-exploited-velocloud-orchestrator-zero","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","2026-10-23T15:26:13.908+00:00"]