Node.js high-severity CVE-2026-111497 enables RCE via Brotli decompression
andersonbcdefg · x · 2026-10-22
Aikido Security disclosed CVE-2026-111497 ("Node2Shell", high): a Node.js process decompressing attacker-controlled Brotli data can leak memory or run arbitrary code. Apps using built-in fetch(), body-parser, or libraries that decompress untrusted Brotli data are exposed; patches are available.
More from Safety
- Compromised eMudhra intermediate CAs could mint valid fake certificates for any domain — i_dg23 · 2026-10-22
- Treasury Secretary Bessent shrugs off 'systemic' AI risks at private investor event — nordicinst · 2026-10-22
- Lawyer: AI-hacked bank accounts are covered, but AI scams are on you — sebkrier · 2026-10-22
- Researcher: Stop confusing vulnerability disclosures with active exploitation — sebkrier · 2026-10-22
- Four cyber events in 24 hours: GitLab CVSS 10 RCE, Railway secrets exposure, HTTP/3 DoS flaws — josh_bickett · 2026-10-22
- Security incidents will 100x demand for open source models, argues dev — zack_overflow · 2026-10-22