Tag

Node.js

3 stories

Node.js release closes 16 security holes across three supported lines

The Node.js project has released fixes for 16 security flaws across its 22.x, 24.x and 26.x lines. Seven are rated high, six medium, and three low. The patched builds are v22.23.5, v24.22.3 and v26.13.1, and the update also refreshes three bundled parts: llhttp, undici and sqlite. Remote memory exposure and server crashes The most serious issue is CVE-2026-123864, which affects the HTTPS code in all three lines. A client with…

Saugata DattaNov 12, 20263 min read20

Cloudflare

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Cloudflare has released an emergency Web Application Firewall (WAF) ruleset update tied to CVE-2026-111497, a memory flaw in Node.js’s Brotli decoder. Published on October 25, 2026, the update adds two new detections designed to surface potentially risky traffic related to the vulnerability while leaving blocking decisions to customers by default. What Cloudflare added The release introduces two rules: one that detects requests declaring a Brotli-compressed request body and another that…

Saugata DattaOct 26, 20263 min read216

Cybersecurity

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Imperva researchers have demonstrated a proof-of-concept exploit—dubbed “Node2Shell”—that uses crafted Brotli-compressed data to achieve remote code execution (RCE) against an official Node.js 24.22.0 build for Linux arm64. The issue, tracked as CVE-2026-111497, was disclosed by Node.js and patched on October 21, 2026. While the demonstration did not work reliably on every attempt and targeted a specific build and architecture, it highlights a real risk for services that decode untrusted Brotli…

Saugata DattaOct 23, 20265 min read283

Node.js release closes 16 security holes across three supported lines

Cloudflare Issues Emergency WAF Rules for CVE-2026-111497 Brotli Flaw

Node2Shell: Crafted Brotli Data Lets Code Run in an Official Node.js Build — What Operators Need to Know

Free Tools: IP, DNS, SSL