NewsThe Hacker News
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
Linked advisories
- CVE-2026-111497Google Brotli — Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
- CVE-2026-111497Brotli vulnerability
- CVE-2026-111497CVE-2026-111497 affecting Brotli Decoder
- CVE-2026-111497Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Debian LTS brotli: security update
- CVE-2026-111497Google Brotli: ungeprüfter Rückgabewert
- CVE-2026-111497Out-of-bounds write in the brotlicffi decoder ("Node2Shell") also affects the PyPI Brotli package
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-111497Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products
- CVE-2026-111497Brotli vulnerability
- CVE-2026-111497Critical Vulnerability in Node.js
- CVE-2026-111497OSV-Eintrag
- CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-111497Google Brotli Remote Code Execution Vulnerability
- CVE-2026-111497Debian brotli: security update
- CVE-2026-111497Node2Shell CVEs
- CVE-2026-111497Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- CVE-2026-111497Node.js Multiple Vulnerabilities
- CVE-2026-111497Node2Shell / HTTP2Shell: Brotli RCE (CVE-2026-111497) in Node.js, Python, Envoy and Istio + Node.js October releases
- CVE-2026-111497Node.js: Mehrere Schwachstellen
Affected vendors and products
More on Software
Other advisories
- CriticalCVE-2026-118633Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten
- HighCVE-2026-111419Foxit Software Foxit.com: hartcodierte Zugangsdaten
- HighCVE-2026-111418Foxit Software Foxit.com: Server-Side-Request-Forgery (SSRF)
- HighCVE-2026-111417Foxit Software Foxit.com: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- HighCVE-2026-111417Foxit Software Foxit.com: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- HighCVE-2026-111418Foxit Software Foxit.com: Server-Side-Request-Forgery (SSRF)
- HighCVE-2026-111419Foxit Software Foxit.com: hartcodierte Zugangsdaten
- MediumCVE-2026-7190A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ en…
Other news entries
- Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenVulnerabilityBSI CERT-Bund
- New Cisco firewall zero-day exploited to crash SSL VPN devicesNewsBleepingComputer
- Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash FirewallsNewsThe Hacker News
- Long-Hidden Flaws Patched in EPICS Research Facility Control SoftwareNewsSecurityWeek
- NCSC-2026-0458 [1.00] [M/H] Kwetsbaarheden verholpen in Cisco Secure Firewall ASA, Threat Defense en Management CenterNewsNCSC-NL
- AI 'hacker' finds 4 severe bugs in popular industrial control software in under 4 hoursNewsThe Register — Security
- Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum EncryptionNewsThe Hacker News
- Microsoft releases emergency .NET security fixes for Google Brotli bugNewsThe Register — Security
Source: https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
ID