[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:rapid-node2shell-node-js-brotli-decoder-rce-cve-2026-111497":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":24,"action_required":26,"article_ids":27,"ioc_summary":33,"source_urls":34,"status":36,"expires_at":37,"created_at":38,"updated_at":39,"articles":40,"rapid":61},"20f9f51b-52f0-433c-95d9-7fcacbcdbf84","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","rapid-node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","critical","cve",[12,13,14,15,16,17,18,19,20,21,22,23],"CVE-2026-106069","CVE-2026-105483","CVE-2026-105482","CVE-2026-106074","CVE-2026-111497","CVE-2026-105481","CVE-2026-106072","CVE-2026-106070","CVE-2026-106071","CVE-2026-106073","CVE-2026-109618","CVE-2026-109619",[25],"Node2Shell","Updating npm deps does not fix this. The bug is in the bundled runtime. Patch Node itself, in containers and SEAs too.",[28,29,30,31,32],"37bd374e-087f-4c12-be65-38a4099c67f2","28243322-0856-4866-be58-213472d80e7c","0b5b2ffb-1374-4062-8811-e075691f0e16","4e14e6af-12db-4e0f-af91-1c14f85efc4f","aa620d10-c8aa-45c2-be9f-4a36d27c04f9",null,[35],"https:\u002F\u002Fthreatnoir.com\u002Fblog\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497","archived","2026-10-26T16:42:51.248+00:00","2026-10-23T16:42:51.401916+00:00","2026-10-25T17:05:02.743793+00:00",[41,45,49,53,57],{"id":28,"title":42,"url":43,"slug":44},"Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fnodejs-brotli-decoder-bug-could-allow.html","node-js-brotli-decoder-bug-could-allow-remote-code-execution-in-all-supported-ve-4681e1",{"id":29,"title":46,"url":47,"slug":48},"After PHP and eMudhra, Here Comes Node.js","https:\u002F\u002Fcheckmarx.com\u002Fzero-post\u002Fafter-php-and-emudhra-here-comes-node-js\u002F","after-php-and-emudhra-here-comes-node-js-b95cae",{"id":30,"title":50,"url":51,"slug":52},"Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fresearchers-demonstrate-node2shell-rce.html","researchers-demonstrate-node2shell-rce-exploit-on-node-js-build-using-crafted-br-5119cb",{"id":31,"title":54,"url":55,"slug":56},"Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F10\u002F23\u002Fnode-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-before-attackers-do","node-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-befor-290013",{"id":32,"title":58,"url":59,"slug":60},"Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fnodejs-october-2026-security-releases-cve-2026-111497.html","node2shell-node-js-brotli-flaw-gets-rce-proof-of-concept-6faa61",{"slug":62,"title":25,"cover_url":63},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png"]