poslední zpráva
SPOJENO AI EPSS 0.01 (nejvyšší)
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats
Brotli brotlicffi Node.js Google BE US NL FI FR IT
CVE v události 10
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-105481 | 6.5 3.0 · hackerone | – | 0.00 |
| CVE-2026-105482 | – | – | 0.00 |
| CVE-2026-105483 | – | – | 0.00 |
| CVE-2026-106069 | – | – | 0.00 |
| CVE-2026-106070 | 3.7 3.0 · hackerone | – | 0.00 |
| CVE-2026-106071 | 3.6 3.0 · hackerone | – | 0.00 |
| CVE-2026-106072 | 6.7 3.0 · hackerone | – | 0.00 |
| CVE-2026-106073 | 3.3 3.0 · hackerone | – | 0.00 |
| CVE-2026-106074 | 4.8 3.0 · hackerone | – | 0.00 |
| CVE-2026-111497 | 9.2 4.0 · Google | – | 0.01 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.
Jak se o tom psalo 7
-
· Aikido Security BE
Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats
-
· Qualys US
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so dependency checks will not surface them. Qualys customers can find affected runtimes across hosts, containers,…
-
· NCSC-NL NL
NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder
Google heeft een kwetsbaarheid verholpen in de Brotli-decompressiebibliotheek. Deze bibliotheek wordt onder meer gebruikt in Node.js. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door speciaal vervaardigde Brotli-gecomprimeerde gegevens te laten verwerken. Succesvol misbruik kan leiden tot een denial-of-service, toegang tot gevoelige gegevens uit het procesgeheugen of het uitvoeren van willekeurige code met de rechten van het getroffen proces.
-
· zachyceno · NCSC-FI FI
Node.js October 21, 2026 Security Releases
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: This security release includes the following dependency updates to address public vulnerabilities: c-ares on 26.x, 24.x, 22.x ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x OpenSSL on 24.x, 22.x SQLite on 22.x Undici…
-
· Aikido Security BE nadpis události
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats
-
· zachyceno · CERT-FR – avis FR
Multiples vulnérabilités dans Node (22 octobre 2026)
De multiples vulnérabilités ont été découvertes dans Node.js. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et un problème de sécurité non spécifié par l'éditeur.
-
· CSIRT Itálie (ACN) IT
Node.js: risolte molteplici vulnerabilità
Rilasciati aggiornamenti di sicurezza che risolvono 10 vulnerabilità, di cui 4 con gravità “alta”, in Node.js, noto software open source per l’esecuzione di codice Javascript. Tali vulnerabilità, qualora sfruttate, potrebbero permettere ad un utente malintenzionato l'elusione dei meccanismi di sicurezza e/o la compromissione della disponibilità dei servizi interessati.