Research

Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the […]

Read at Qualys Threat Research Unit

Vendor

Qualys, Node.js

Product

Qualys Cloud Agent, Node.js

EPSS

0.83 (p100)

Fix

not yet available

Exposure class

Network management, Developer platform

• Qualys Threat Research Unit (blog.qualys.com)
• CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-106069 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-105483 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-105482 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-106072 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical
2. 38
   Research Datadog Security Labs 3d ago

   Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

   EPSS 0.83 CVE-2026-111497 Node.js
3. 48
   AWS bulletin AWS 3d ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   EPSS 0.83 CVE-2026-111497 Amazon Web Services
4. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   EPSS 0.83 CVE-2026-111497 Google Node.js
5. 39
   CCCS advisory CCCS 3d ago

   AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497

   EPSS 0.83 CVE-2026-111497 Google
6. 58
   Research Sophos X-Ops 4d ago

   Node2Shell (CVE-2026-111497) in active exploitation

   Exploited EPSS 0.83 CVE-2026-111497
7. 53
   Cisco advisory Cisco PSIRT 4d ago

   Vulnerabilities in Node.js Affecting Cisco Products: October 2026

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
8. 69
   CISA alert CISA 4d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
9. 42
   Outbreak alert FortiGuard 5d ago

   Node2Shell Remote Code Execution

   EPSS 0.83 CVE-2026-111497 Google Node.js
10. 41
    Tenable research Tenable 5d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
11. 56
    News CyberScoop 5d ago

    Experts temper emergency-level alarms over critical Brotli defect

    Exploited EPSS 0.83 CVE-2026-111497
12. 55
    Threat signal FortiGuard 5d ago

    Node.js Brotli Remote Code Execution (Node2Shell)

    PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js
13. 37
    Palo Alto advisory Palo Alto PSIRT 5d ago

    Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks
14. 31
    News The Register 5d ago

    Microsoft releases emergency .NET security fixes for Google Brotli bug

    EPSS 0.83 CVE-2026-111497 Microsoft Google
15. 81
    Research Rapid7 5d ago

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
16. 39
    CCCS advisory CCCS 5d ago

    Google security advisory (AV26-1085)

    EPSS 0.83 CVE-2026-111497 Google
17. 66
    Advisory Fortinet PSIRT 6d ago

    Node2Shell CVEs

    CVSS 9.8 EPSS 0.83 CVE-2026-105482CVE-2026-105483CVE-2026-106069+7 more Fortinet Node.js
18. 31
    Wiz Research Wiz 6d ago

    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

    EPSS 0.83 CVE-2026-111497
19. 37
    Advisory MSRC 6d ago

    Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

    EPSS 0.83 CVE-2026-111497 Microsoft Google
20. 17
    CVE NVD 8d ago

    A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks.

    CVSS 3.3 CVE-2026-106073 Node.js