EPSS 0.00 (nejvyšší)
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so dependency checks will not surface them. Qualys customers can find affected runtimes across hosts, containers,…
Node.js US
CVE v události 10
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-105481 | – | – | – |
| CVE-2026-105482 | – | – | – |
| CVE-2026-105483 | – | – | – |
| CVE-2026-106069 | – | – | – |
| CVE-2026-106070 | – | – | – |
| CVE-2026-106071 | – | – | – |
| CVE-2026-106072 | – | – | – |
| CVE-2026-106073 | – | – | – |
| CVE-2026-106074 | – | – | – |
| CVE-2026-111497 | 9.2 4.0 · Google | – | 0.00 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.