上次审核
评估
node2shell
CVE-2026-111497
CVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.
风险
The decoder is used beyond Node.js, including in server-side fetches. The October 25 review did not confirm active exploitation.
建议操作
Update or remove vulnerable Brotli decoders using each vendor's guidance, including copies bundled with runtimes or container images.