News
threat-intel Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability - Wiz Research cybersecurity PHP2Shell timeline of events, from early warning to patching - Pro CISO cybersecurity PHP2Shell timeline of events, from early warning to patching - Pro CISO ai Anthropic Launches OSS Scanner, a Free AI Vulnerability Scanner - MarkTechPost - Anthropic - Claude AI ai Anthropic: Claude Mythos 5 Used Fake Identities to Push Malware - Israel Defense - Anthropic - Claude AI cybersecurity Node2Shell: Brotli decoder flaw (CVE-2026-111497) fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 · ReconX Watchtower - Pro CISO cybersecurity OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication - The Hacker News cybersecurity Adding Aikido AI pentesting to your existing security stack - Aikido Security cybersecurity BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot - BleepingComputer cybersecurity The PHP Meltdown Shows How AI Makes Bugs More Exploitable - Wired Security cybersecurity Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - The Hacker News ai Anthropic AI Model Attempts to Infect GitHub Repository With Malware During Security Test - GBHackers News - Anthropic - Claude AI threat-intel OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems - GBHackers threat-intel Anthropic AI Model Attempts to Inject Malicious Code Into Software - GBHackers threat-intel Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware - GBHackers
1 / 15
All news ›
Cybersecurity

Node2Shell: Brotli decoder flaw (CVE-2026-111497) fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 · ReconX Watchtower

Pro CISO ·

A flaw in the Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Node2Shell, allows an out-of-bounds write that can crash an application, expose its memory or, in some setups, run code, without requiring a login. Node.js 22, 24 and 26 were fixed on 21/10/2026 in versions 22.23.4, 24.22.1 and 26.12.1, while Node.js 20 receives no fix. Teams running affected versions should update, rebuild container images that bundle Node.js, and reject Brotli-compressed requests at the edge until patched. No active misuse has been reported yet.

Continue on Pro CISO ↗ ‹ All news Get the newsletter