CISA lists exploited Node2Shell flaw CVE-2026-111497
Federal agencies must fix it by November 10; patched Node.js releases are 22.23.4, 24.22.1 and 26.12.1.
88
Product
Express
- Mentions · 7d1
- Mentions · 30d3
- All mentions5
- First seenSep 9, 2026
- Last mentioned2d ago
Timeline
5 articles · newest firstNode2Shell PoC runs code through Node.js Brotli decoder flaw
Imperva’s proof of concept worked on Node.js 24.22.0; fixed builds are 22.23.4, 24.22.1, and 26.12.1.
66
Imperva shows Node2Shell RCE on stock Node.js via Brotli
Crafted Brotli data ran code on Node.js 24.22.0 Linux arm64; 24.22.1 rejected it, and no wild attacks were reported.
72
Ubiquiti security advisory (AV26-954)
Canada's Cyber Centre warns of vulnerabilities in multiple Ubiquiti UniFi gateways, routers, and firewalls and urges updates.
40
Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs
Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.
55
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
Appears with
- Impervaorganization · 3
- Node.jsproduct · 2
- CISAorganization · 1
- Enterprise Firewallsproduct · 1
- PollCatmalware · 1
- Cloud Gatewaysproduct · 1
- Node2Shellmalware · 1
- Express 7product · 1
- Vercelorganization · 1
- aviationvictim · 1
- Koaproduct · 1
- body-parserproduct · 1
- Dream Wallproduct · 1
- NodeRabbitproduct · 1
- Node.jsvendor · 1
- Ubiquitivendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.