Skip to content
Critical Node2Shell Vulnerability (CVE-2026-111497) Under Active Exploitation

Critical Node2Shell Vulnerability (CVE-2026-111497) Under Active Exploitation

First seen 29 Oct 2026, 02:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 01:44 UTC
  • •CVE-2026-111497 is a critical vulnerability with a CVSS score of 9.2.
  • •Active exploitation has been confirmed, particularly targeting Node.js 24.22.0.
  • •Multiple security vendors have released advisories and patches for affected systems.

On October 21, 2026, Node.js disclosed CVE-2026-111497, a critical out-of-bounds write vulnerability in Google's Brotli decoder, with a CVSS score of 9.2. This flaw allows attackers to exploit specially crafted compressed data, potentially leading to remote code execution (RCE) and memory disclosure. Active exploitation attempts have been reported, particularly against Node.js version 24.22.0, and the vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog. Multiple security vendors, including Cisco and Palo Alto Networks, have released advisories and patches. Organizations are urged to apply updates immediately to mitigate risks. The vulnerability affects various software frameworks that utilize the Brotli decoder, including Node.js, Python, and .NET. Security researchers have confirmed successful exploitation in testing environments, highlighting the urgency of remediation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 9h ago How this analysis works

Timeline

2026-10-21
CVE-2026-111497 disclosed
Node.js announced a critical out-of-bounds write vulnerability in the Brotli decoder, affecting multiple software frameworks.
Sec.Cloudapps.Cisco
2026-10-22
CVE-2026-111497 added to CISA KEV
CISA included CVE-2026-111497 in its Known Exploited Vulnerabilities catalog due to active exploitation.
Digital.Nhs.Uk
2026-10-22
Public exploit for CVE-2026-105482 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-23
CVE-2026-106069 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-23
CVE-2026-105483 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-27
Active exploitation reported
Security researchers confirmed active exploitation attempts against vulnerable systems, particularly Node.js.
Digital.Nhs.Uk

More articles in this cluster (14)

Following this threat?

Track CISA and CVE-2026-105482 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (22)

1 / 4

Common questions

Which software is affected by CVE-2026-111497?
The vulnerability affects various software frameworks using the Brotli decoder, including Node.js, Python, and .NET.
What is the current status of exploitation?
Active exploitation has been confirmed, with reports of successful code execution against Node.js 24.22.0.
What should organizations do to protect themselves?
Organizations should apply the latest patches from their vendors immediately to mitigate the risk of exploitation.