KEV ✓ (1 z 8) EPSS 0.55 (nejvyšší)
Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own
Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the meantime, interim mitigations from the Qualys Threat Research Unit narrow the Brotli, DNS, TLS, and keep-alive attack paths, and WAF, IPS, and EDR…
Node.js US
CVE v události 8
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-105481 | 6.5 3.0 · hackerone | – | 0.00 |
| CVE-2026-105482 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-105483 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-106069 | 7.4 3.0 · hackerone | – | 0.00 |
| CVE-2026-106071 | 3.6 3.0 · hackerone | – | 0.00 |
| CVE-2026-106072 | 6.7 3.0 · hackerone | – | 0.01 |
| CVE-2026-106073 | 3.3 3.0 · hackerone | – | 0.00 |
| CVE-2026-111497 | 9.2 4.0 · Google | KEV ✓ | 0.55 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.