Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
Stories per day · 30 days
Relatedbrotli30envoy8node2shell7php7rce7supply-chain6tls6istio5remote-code-execution5dns4dotnet4kev4litellm4memory-corruption4buffer-overflow3http2shell3openssl3python3
62 stories, newest first · one card per story
Stories tagged #nodejs
Terminal2Shell ‘zero-day’ is satire, not a confirmed flaw
Opening a terminal as a signed-in user is ordinary behavior, and the claimed CVSS 11.0 exceeds the official scale.
1
Insignary releases free tool to detect PHP2Shell and Node2Shell exposures
insignary-chk is a free read-only scanner that helps organizations find Linux servers and container images exposed to PHP2Shell and Node2Shell vulnerabilities.
Node.js schedules security fixes for 22.x 24.x and 26.x lines
Node.js will release high-severity patches for supported 22.x 24.x and 26.x branches on or after November 11 2026 following earlier TLS DNS and Brotli fixes.
1
Node.js Security Releases Pre-Alert
New versions of Node.js 22, 24, and 26 will address undisclosed vulnerabilities.
Hacktober 2026 wave of cyberattacks hits Binance, PHP, Node.js, and LiteLLM
Binance reports $6.3B unauthorized transactions while PHP and Node.js vulnerabilities are fixed and the Pentagon breach affects millions.
Lasm targets formally verified web apps in Lean
The Hacker News post has 21 points and 3 comments; the feed gives no technical or release details.
Checkmarx says PHP patch rush shows remediation bottlenecks
A PHP advisory requires a runtime update because the attack path can run before application code.
CISA catalogs actively exploited Node.js Brotli RCE CVE-2026-111497
Agencies must remediate by November 10; Node.js fixes are 22.23.4, 24.22.1 and 26.12.1.
Brotli decoder flaw CVE-2026-111497 exploited across many runtimes
CISA lists the out-of-bounds write; a public proof of concept crashes standard builds, and patched Node.js still reports Brotli 1.2.0.
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
CISA confirms exploitation of critical Brotli flaw CVE-2026-111497
Federal agencies must remediate by November 10; others should patch or block Brotli-compressed requests until libraries are updated.
CISA lists Brotli Node2Shell flaw as honeypots log attempts
CVE-2026-111497 hits Brotli 1.0.3 through 1.2.0; US civilian agencies must address it by November 10.
3
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
2
Brotli decoder bug allows remote code execution (CVE-2026-111497)
ELLIO says sensors saw public exploit traffic; Node.js branches and other bundled decoders need patched builds.
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
Google Brotli decoder CVE-2026-111497 can yield remote code execution
Google scored it 9.2; major runtimes have fixes, but some projects had not shipped a fixed release as of October 26.
Brotli flaw CVE-2026-111497 can crash systems or run code; no attacks seen
OpenAI Codex Security found the Google library bug, Node.js disclosed it on October 21, and dependents shipped emergency patches.
Microsoft ships emergency .NET fixes for Brotli flaw CVE-2026-111497
The CVSS 8.1 buffer overflow can disclose data, crash processes, or raise privileges; working exploits exist but attacks are not confirmed.
Node.js Brotli decoder flaw can crash or run code (CVE-2026-111497)
Fixed builds are 22.23.4, 24.22.1 and 26.12.1; Rapid7 reports no known exploitation and it is not on the KEV list.
Brotli flaw CVE-2026-111497 prompts emergency Node.js and .NET patches
Fixed builds include Brotli 1.2.1 and Node.js 22.23.4; public proof-of-concept exploits exist, with no attacks reported.
Cloudflare adds log-only WAF rules tied to Brotli flaw CVE-2026-111497
The October 25 rules watch Brotli request bodies and Next.js /_next/image traffic; customers must opt in to blocking.
1
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
1
Fortinet lists Node.js flaws including Brotli decoder RCE
One issue, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that permits remote code execution.