Advisories

Node2Shell CVEs

CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106072 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106074 - (medium)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-106070 - (low

Read at Fortinet PSIRT Advisories

Vendor

Fortinet, Node.js

Product

Node.js

CVSS v3.0

9.8

EPSS

0.83 (p100)

Exposure class

Developer platform

• Fortinet PSIRT Advisories (fortiguard.fortinet.com)
• CVE-2026-105482 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-105483 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-106069 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-105481 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical
2. 38
   Research Datadog Security Labs 3d ago

   Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

   EPSS 0.83 CVE-2026-111497 Node.js
3. 48
   AWS bulletin AWS 3d ago

   CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

   EPSS 0.83 CVE-2026-111497 Amazon Web Services
4. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   EPSS 0.83 CVE-2026-111497 Google Node.js
5. 39
   CCCS advisory CCCS 3d ago

   AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497

   EPSS 0.83 CVE-2026-111497 Google
6. 36
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   EPSS 0.83 No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js
7. 58
   Research Sophos X-Ops 4d ago

   Node2Shell (CVE-2026-111497) in active exploitation

   Exploited EPSS 0.83 CVE-2026-111497
8. 53
   Cisco advisory Cisco PSIRT 4d ago

   Vulnerabilities in Node.js Affecting Cisco Products: October 2026

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+1 more Cisco Node.js
9. 69
   CISA alert CISA 4d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.83 CVE-2026-48356CVE-2026-111497 Google Adobe
10. 42
    Outbreak alert FortiGuard 5d ago

    Node2Shell Remote Code Execution

    EPSS 0.83 CVE-2026-111497 Google Node.js
11. 41
    Tenable research Tenable 5d ago

    Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

    EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js
12. 56
    News CyberScoop 5d ago

    Experts temper emergency-level alarms over critical Brotli defect

    Exploited EPSS 0.83 CVE-2026-111497
13. 55
    Threat signal FortiGuard 5d ago

    Node.js Brotli Remote Code Execution (Node2Shell)

    PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js
14. 37
    Palo Alto advisory Palo Alto PSIRT 5d ago

    Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

    EPSS 0.83 CVE-2026-111497 Palo Alto Networks
15. 31
    News The Register 5d ago

    Microsoft releases emergency .NET security fixes for Google Brotli bug

    EPSS 0.83 CVE-2026-111497 Microsoft Google
16. 81
    Research Rapid7 5d ago

    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

    Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js
17. 39
    CCCS advisory CCCS 5d ago

    Google security advisory (AV26-1085)

    EPSS 0.83 CVE-2026-111497 Google
18. 31
    Wiz Research Wiz 6d ago

    Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

    EPSS 0.83 CVE-2026-111497
19. 37
    Advisory MSRC 6d ago

    Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

    EPSS 0.83 CVE-2026-111497 Microsoft Google
20. 20
    CVE NVD 8d ago

    A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be…

    CVSS 4.8 CVE-2026-106074 Node.js