Section

Research

Threat intelligence and technical research from vendor labs, coordination centers and independent researchers.

9 matching records, 1 with confirmed exploitation.

1. 81
   Research Rapid7 5d ago

   CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

   Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x , 24.x , and 22.x…

   Exploited CVSS 9.2 EPSS 0.83 CVE-2026-111497 Google Node.js Developer platform
2. 55
   Threat signal FortiGuard 5d ago

   Node.js Brotli Remote Code Execution (Node2Shell)

   What is the Vulnerability? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web…

   PoC public EPSS 0.83 Fix available CVE-2026-111497 Google Node.js Developer platform
3. 41
   Tenable research Tenable 5d ago

   Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

   Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes…

   EPSS 1.00 Fix available CVE-2026-111497CVE-2026-109618CVE-2026-109619 Google Node.js Developer platform
4. 39
   Qualys TRU Qualys 8d ago

   Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

   Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write…

   EPSS 0.83 Fix available CVE-2026-111497CVE-2026-105482CVE-2026-105483+7 more Node.js Developer platform
5. 38
   Research Datadog Security Labs 3d ago

   Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

   We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.

   EPSS 0.83 CVE-2026-111497 Node.js Developer platform
6. 38
   Research ThreatLabz 3d ago

   CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

   IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and…

   EPSS 0.83 CVE-2026-111497 Google Node.js Developer platform
7. 36
   Qualys TRU Qualys 4d ago

   Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own

   Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3…

   EPSS 0.83 No fix yet CVE-2026-111497CVE-2026-106069CVE-2026-105483+6 more Qualys Node.js Network management
8. 15
   Talos research Talos 2d ago

   A quiet week in infosec <.<

   In this edition of the Threat Source newsletter, William explores how PHP has taken over the conversation, Node.js has joined in, but underneath it all, there are still good people doing good work.

   Node.js Developer platform
9. 9
   Research Elastic Security Labs 20d ago

   Auditing the auditor: Unmasking Apex Accelerator

   REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery.

   Node.js Developer platform

Same filters as JSON: /api/items?category=research&window=30d&vendor=Node.js&limit=100. RSS for this section: feed.xml.