CVE-2026-106070

Vendor

Node.js

Product

ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js

CVSS

3.7

EPSS

0.005 (p41)

Exposure class

Developer platform, Network management

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 51
   Advisory Fortinet PSIRT 6d ago

   Node2Shell CVEs

   CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js…

   CVSS 9.8 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
2. 24
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js
3. 21
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…

   No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
4. 17
   CVE NVD 8d ago

   A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header…

   A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local…

   CVSS 3.7 CVE-2026-106070 Node.js