NewsThe Hacker News
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Linked advisories
- CVE-2026-111497Google Brotli — Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
- CVE-2026-111497Brotli vulnerability
- CVE-2026-111497Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Debian LTS brotli: security update
- CVE-2026-111497Google Brotli: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-111497Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
- CVE-2026-111497Critical Vulnerability in Node.js
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Debian brotli: security update
- CVE-2026-111497Multiple Node.js CVEs
- CVE-2026-111497Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- CVE-2026-111497Node.js Multiple Vulnerabilities
- CVE-2026-111497Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
- CVE-2026-111497Node.js: Mehrere Schwachstellen
Affected vendors and products
More on Software
Other advisories
- LowCVE-2026-103995Python Software Foundation CPython: HTTP Request Smuggling
- LowCVE-2026-103995Python Software Foundation CPython: HTTP Request Smuggling
- CriticalCVE-2026-108015HCLSoftware Notes Client: unsicherer kryptografischer Algorithmus
- CriticalCVE-2026-108014HCLSoftware Domino Server: unsicherer kryptografischer Algorithmus
- CriticalCVE-2026-108015HCLSoftware Notes Client: unsicherer kryptografischer Algorithmus
- CriticalCVE-2026-108014HCLSoftware Domino Server: unsicherer kryptografischer Algorithmus
- CriticalCVE-2026-116863Tribulant Software Newsletters: Cross-Site-Request-Forgery (CSRF)
- CriticalCVE-2026-116863Tribulant Software Newsletters: Cross-Site-Request-Forgery (CSRF)
Other news entries
- AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hoursNewsThe Register — Security
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum EncryptionNewsThe Hacker News
- Microsoft releases emergency .NET security fixes for Google Brotli bugNewsThe Register — Security
- 10 Software Security Practices Built for the Next 250 YearsNewsDark Reading
- Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape SandboxesNewsThe Hacker News
- There's a third PHP2Shell bug, but it won't get an emergency fixNewsThe Register — Security
- Dual BIOS: The laptop security feature SMBs don’t know they needNewsCSO Online
- LiteLLM release pipeline hacked to distribute credential-stealing malwareNewsCSO Online
Source: https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
ID