Node.js patched Brotli flaw CVE-2026-111497; more fixes scheduled
First merged summary.
October Node.js releases fixed CVE-2026-111497, while further high-severity updates are due on or after November 11.
Node.js fixed Brotli decoder flaw CVE-2026-111497, called Node2Shell or HTTP2Shell, in October releases 22.23.4, 24.22.1, and 26.12.1. Cyber Security News reports the fixes shipped on October 21 and that CISA listed the flaw in the KEV catalog. Help Net Security, citing Sweet, calls it critical remote code execution in Node.js, Bun, Envoy, and Python, with exploit attempts in 88 percent of monitored environments; Cisco calls it an out-of-bounds write that may allow code execution and affect Cisco products. Sweet and Impart are offering virtual patches, and Insignary released a free Linux scanner. Node.js separately scheduled more high-severity updates for 22.x, 24.x, and 26.x on or after November 11, without naming CVEs, while Cisco presents those lines as carrying the Brotli fix.
- CVE-2026-111497 is a Brotli decoder out-of-bounds write tracked as Node2Shell or HTTP2Shell.
- Cyber Security News cites fixed builds 22.23.4, 24.22.1, and 26.12.1.
- Fixes were released on October 21, 2026, according to Cyber Security News.
- Sweet, via Help Net Security, claims exploit attempts in 88 percent of monitored environments.
- Node.js targets additional high-severity updates for 22.x, 24.x, and 26.x on or after November 11.
- Insignary’s free insignary-chk scanner checks Linux x86_64 hosts and container images.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Node.js releases fixes for the Brotli flaw · Cyber Security News
- Nov 3, 2026Sweet promotes virtual patching for HTTP2Shell · Help Net Security
- Nov 4, 2026Node.js warns of further high-severity updates · Cyber Security News
- Nov 4, 2026Cisco says Node.js and Brotli flaws affect its products · Cisco Security Advisories
- Nov 7, 2026Insignary releases a free exposure scanner · Cyber Security News
What each outlet adds
beyond the shared facts- Help Net SecuritySweet claims 88 percent exploit attempts and offers an eBPF virtual patch.
- Help Net SecurityImpart says AI can produce tested WebAssembly virtual patches within 60 minutes.
- Cyber Security NewsNames the October fixed builds and the November 11 update window.
- Cisco Security AdvisoriesSays the Brotli write and a DNS flaw affect Cisco products.
- Cyber Security NewsReports CISA KEV listing and Insignary’s free read-only Linux scanner.
- Organizations
- OpenAI
- AI models
- OpenAI agents
Coverage
oldest first · one row per article · UTC- · 6d ago
Help Net SecurityFirst report
Sweet Virtual Patching Stops HTTP2Shell Vulnerability
Sweet Virtual Patching protects Node.js and other runtimes from HTTP2Shell until permanent Brotli fixes are released.
- · 5d ago
Impart launches Runtime Defense Harness for AI virtual patches
AI agents write tested virtual patches in 60 minutes enforced inline as WebAssembly without traffic path impact.
- · 5d ago
Cyber Security News
Node.js schedules security fixes for 22.x 24.x and 26.x lines
Node.js will release high-severity patches for supported 22.x 24.x and 26.x branches on or after November 11 2026 following earlier TLS DNS and Brotli fixes.
- · 4d ago
Cisco Security Advisories
Node.js vulnerabilities affecting Cisco products fixed in October 2026
Node.js 22.x, 24.x, and 26.x releases address multiple vulnerabilities including Brotli decoder out-of-bounds write and DNS resolution issues.
- · 2d ago
Insignary releases free tool to detect PHP2Shell and Node2Shell exposures
insignary-chk is a free read-only scanner that helps organizations find Linux servers and container images exposed to PHP2Shell and Node2Shell vulnerabilities.
- · 2d ago
GBHackers
Insignary releases free tool to detect PHP2Shell and Node2Shell exposures
insignary-chk is a free read-only scanner that helps organizations find Linux servers and container images exposed to PHP2Shell and Node2Shell vulnerabilities.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105482 | NUL-byte truncation in Node.js dns.resolve* and dns.reverse | 7.4 | <1% | PoC ×2 | |
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |