News
cybersecurity Cursor confirms security breach led to malicious Claude Code extension - BleepingComputer ai AI chief warns humanity is facing 'tsunami of vulnerability' and says 'it'll get worse' - Daily Express US - Anthropic - Claude AI cybersecurity Beware the New AI-Fueled Ransomware Boom - Wired Security cybersecurity Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection - The Hacker News cybersecurity Uber Data Breach Exposes Thousands of Drivers’ License Records in Fireworks AI Attack - CyberPress cybersecurity Microsoft Threat Intelligence (@MsftSecIntel) on X - Pro CISO threat-intel BlackNevas Ransomware Attacks VMware ESXi Servers, Destroying Virtual Machines and Backup Infrastructure - GBHackers threat-intel CISA Warns of Actively Exploited Check Point Zero-Day Vulnerability Allowing Attackers to Gain Root Access - GBHackers threat-intel Hackers Use Stolen LLM API Keys to Power ARTEX AI Agents and Continue Credential Theft - GBHackers threat-intel FBI Warns Hackers Are Weaponizing ARTEX AI Framework to Launch Autonomous Cyberattacks Worldwide - GBHackers threat-intel Hackers Use Falcon C2 Framework to Hijack Browsers and Steal Credentials From Government Agencies - GBHackers threat-intel Japan Hit by Record Cyberattack Surge as Hackers Use AI to Exploit Security Vulnerabilities - GBHackers cybersecurity BlackNevas Ransomware Gang Destroys VMware ESXi Servers and Backups in 10-Day Attack - CyberPress cybersecurity CISA Warns of Actively Exploited Check Point Zero-Day Allowing Root Access - CyberPress threat-intel Uber Hacked – Hackers Steal Drivers’ License Personal Data - GBHackers
1 / 15
All news ›
Cybersecurity

Node2Shell: Brotli decoder flaw (CVE-2026-111497) fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 · ReconX Watchtower

Pro CISO ·

A flaw in the Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Node2Shell, allows an out-of-bounds write that can crash an application, expose its memory or, in some setups, run code, without requiring a login. Node.js 22, 24 and 26 were fixed on 21/10/2026 in versions 22.23.4, 24.22.1 and 26.12.1, while Node.js 20 receives no fix. Teams running affected versions should update, rebuild container images that bundle Node.js, and reject Brotli-compressed requests at the edge until patched. No active misuse has been reported yet.

Continue on Pro CISO ↗ ‹ All news Get the newsletter