Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

vulnerability

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the proj…

The Hacker News · 1d ago Medium

CVE-2026-106069 CVE-2026-105483 CVE-2026-105482 IN vulnerability remote code execution brotli

vulnerability

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

Researchers at Imperva demonstrated a Remote Code Execution (RCE) vulnerability, CVE-2026-111497, in Node.js applications due to crafted Brotli data. Vercel added rules to block the attack in inbound requests, but this d…

The Hacker News · 5h ago HighCVSS 9.2

CVE-2026-111497 vulnerability brotli rce

news.mlab.sh

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data