advisory.splunk.com Critical Vulnerabilities in Node.js Affecting Multiple Platforms
Article Content
- •CVE-2026-111497 is a critical vulnerability with a CVSS score of 9.2, allowing potential RCE.
- •Multiple platforms, including Node.js, Python, and .NET, are affected by these vulnerabilities.
- •CISA has listed CVE-2026-111497 as actively exploited, emphasizing the urgency for patches.
On October 21, 2026, Node.js disclosed multiple vulnerabilities, including CVE-2026-111497, a critical out-of-bounds write flaw in the Brotli decoder with a CVSS score of 9.2. This vulnerability can lead to remote code execution (RCE) and affects various platforms using Node.js, including libraries and runtimes like Python and.NET. Other vulnerabilities disclosed include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, all rated high with CVSS scores of 7.4. The vulnerabilities pose risks for traffic interception and process crashes. Cisco and Splunk are currently assessing their products for potential impacts. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27, 2026, indicating in the wild. Organizations are urged to patch affected systems immediately.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-105482 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of Node.js are affected?
What should organizations do immediately?
Is there confirmed exploitation of these vulnerabilities?
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like…