Back to Zero Wire

Node.js

Security briefings tagged with Node.js

Needs attention

Zuletzt geprüft

Bewerten

node2shell

CVE-2026-111497

CVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.

Details anzeigen

Risiko

The decoder is used beyond Node.js, including in server-side fetches. The October 25 review did not confirm active exploitation.

Empfohlene Maßnahme

Update or remove vulnerable Brotli decoders using each vendor's guidance, including copies bundled with runtimes or container images.