poslední zpráva
SPOJENO AI EPSS 0.00 (nejvyšší)
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats
Brotli brotlicffi Node.js Google BE US NL FI
CVE v události 10
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-105481 | 6.5 3.0 · hackerone | – | – |
| CVE-2026-105482 | – | – | – |
| CVE-2026-105483 | – | – | – |
| CVE-2026-106069 | – | – | – |
| CVE-2026-106070 | 3.7 3.0 · hackerone | – | – |
| CVE-2026-106071 | 3.6 3.0 · hackerone | – | – |
| CVE-2026-106072 | 6.7 3.0 · hackerone | – | – |
| CVE-2026-106073 | 3.3 3.0 · hackerone | – | – |
| CVE-2026-106074 | 4.8 3.0 · hackerone | – | – |
| CVE-2026-111497 | 9.2 4.0 · Google | – | 0.00 |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.
Jak se o tom psalo 5
-
· Aikido Security BE
Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)
The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats
-
· Qualys US
Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so dependency checks will not surface them. Qualys customers can find affected runtimes across hosts, containers,…
-
· NCSC-NL NL
NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder
Google heeft een kwetsbaarheid verholpen in de Brotli-decompressiebibliotheek. Deze bibliotheek wordt onder meer gebruikt in Node.js. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door speciaal vervaardigde Brotli-gecomprimeerde gegevens te laten verwerken. Succesvol misbruik kan leiden tot een denial-of-service, toegang tot gevoelige gegevens uit het procesgeheugen of het uitvoeren van willekeurige code met de rechten van het getroffen proces.
-
· zachyceno · NCSC-FI FI
Node.js October 21, 2026 Security Releases
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: This security release includes the following dependency updates to address public vulnerabilities: c-ares on 26.x, 24.x, 22.x ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x OpenSSL on 24.x, 22.x SQLite on 22.x Undici…
-
· Aikido Security BE nadpis události
Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats