Node.js

Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments

A severe vulnerability has been identified in the Google-developed Brotli decoder used for decompressing data in web communications and other applications. The flaw, tracked as CVE-2026-111497, allows out-of-bounds writes when processing specially crafted compressed data, potentially enabling arbitrary code execution, information disclosure, or denial of service. It carries a CVSS v4.0 base score of 9.2 and is rated Critical. Google has released patched versions 1.2.1, 1.1.1, and 1.0.10 of the library. Node.js incorporated the fix in its updates, while Microsoft issued an out-of-band patch for .NET on October 25, 2026, to address the issue. The vulnerability affects any environment relying on the Brotli C implementation for data decompression.

Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy

A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.

Top Cybersecurity Articles October 18-24 2026: GitLab, nginx, PHP and Node.js Flaws Dominate

Security NEXT published its weekly ranking of the ten most-read articles between October 18 and October 24 2026. The list is led by a critical GitLab vulnerability that also received back-port fixes for older branches. Multiple high-severity issues in the nginx web server, including three rated critical, took second place. PHP disclosed several serious flaws with an update scheduled for October 21, while Node.js prepared a security release for the same date. Additional entries covered actively exploited Fortinet and BeyondTrust vulnerabilities, Chrome 156 fixes for 353 issues, and U.S. government guidance urging immediate patching of PHP flaws or taking systems offline.

Node.js Addresses 10 Vulnerabilities Including High-Severity RCE Risk in Brotli Decompression

The Node.js development team disclosed ten vulnerabilities across multiple versions of the JavaScript runtime on October 21, 2026. Four of the issues received a High severity rating, with one carrying a remote code execution risk through improper handling of Brotli-compressed data. The flaw tracked as CVE-2026-111497 affects Node.js 26.x, 24.x, and 22.x branches and stems from out-of-bounds memory writes during decompression. Additional High-severity problems involve DNS name resolution truncation when NUL characters are present and hostname verification bypasses in TLS certificate validation. The project also resolved three Medium and three Low severity issues related to certificate validation, snapshot entropy reuse, and file-access permission checks. Updated releases Node.js 26.12.1, 24.22.1, and 22.23.4 incorporate fixes for both the core issues and vulnerabilities in bundled components such as c-ares, OpenSSL, SQLite, and Undici. Users of unsupported older branches are advised to migrate to currently maintained versions.

Node.js Fixes High-Severity Brotli Decoder Flaw Leading to Remote Code Execution

A high-severity vulnerability in the bundled Brotli decoder of Node.js allows out-of-bounds writes when processing attacker-controlled compressed data, potentially resulting in remote code execution. The flaw, tracked as CVE-2026-111497, affects all supported branches including 22.x, 24.x, and 26.x prior to the October 21, 2026 security release. Patched versions 22.23.4, 24.22.1, and 26.12.1 address the memory corruption issue that arises during Brotli decompression in services accepting third-party content. The same update resolves additional high-severity problems, notably hostname validation weaknesses in TLS. Organizations using unsupported branches such as 18.x, 20.x, 23.x, and 25.x must migrate to maintained releases, while those linking against system Brotli libraries should verify inclusion of upstream commit 0ed4268. Security teams are advised to audit all environments, including containers and CI pipelines, that process Brotli-encoded data.

Node.js Issues Security Updates Patching Ten Vulnerabilities Including High-Severity TLS Name Verification Bypasses

The Node.js project released security updates on October 21 for release lines 26, 24, and 22, addressing ten vulnerabilities with four rated high severity. The most critical issue, CVE-2026-111497, resides in the Brotli decoder and involves an out-of-bounds write that could enable remote code execution across all three supported lines. Two additional high-severity flaws affect TLS name verification: CVE-2026-105483 bypasses checks when addresses contain full-width digits, while CVE-2026-106069 fails on imprecise IP address resolution, potentially allowing a certificate to be accepted for an unintended destination. A fourth high-severity vulnerability, CVE-2026-105482, causes the dns.resolve function to truncate names containing null characters, creating inconsistencies between queried and resolved names. Medium-severity issues include out-of-order processing in HTTP socket keep-alive, improper certificate validation for non-standard IPv4 addresses, and repeated cryptographic random values in snapshot initialization and single-executable applications affecting crypto.randomUUID and crypto.randomInt. The updates also refresh c-ares, CA certificates, Undici, OpenSSL, and SQLite, with recommendations to test HTTPS outbound connections, DNS handling, Brotli-compressed content, and permission-restricted workloads.

How a Node.js Bridge Connects MAX and VK Messengers to Chatwoot with Secure Bidirectional Sync

A detailed technical case study describes building a lightweight Node.js service that links the MAX messenger and VK communities to Chatwoot without scraping or using personal accounts. The bridge uses official bot APIs and community callbacks, separate API inboxes, and persistent state stored in a Docker volume to maintain conversation mappings across restarts. Security measures include webhook secret validation, deduplication of events using ring buffers, SSRF protections when handling images, and strict filtering to prevent loops or private notes from leaking externally. The implementation covers contact and conversation creation via Chatwoot Application API, image transfer for VK, and graceful recovery after partial failures. Limitations such as lack of exactly-once delivery and absence of a durable queue are acknowledged, with recommendations for production use including SQLite, retries, and structured logging. The author provides configuration examples, health checks, and a capability matrix showing current support for text and media in each direction.

Monero Web Wallet Built on Official monero-wallet-rpc Adds Digest Authentication, Two-Phase Transfers and BigInt Precision

A developer created a non-custodial Monero web wallet that runs entirely on the user's machine and communicates only with a personal monero-wallet-rpc instance. The project retained all key-handling logic inside the official RPC daemon while adding a custom backend, frontend and supporting infrastructure. Eight practical challenges were documented, including HTTP Digest authentication that is tightly coupled to TCP connections and the silent loss of monetary precision caused by JSON.stringify on large numbers. The solution introduced two-phase transaction submission to reduce the risk of broadcast errors and replaced floating-point arithmetic with BigInt to guarantee exact handling of Monero amounts. The resulting implementation demonstrates how to expose a convenient web interface without introducing custodial risk or weakening the security model of the Monero wallet RPC.

Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails

Security NEXT published its list of the ten most-read articles for the week of July 26 to August 1, 2026. The ranking is dominated by high-severity vulnerabilities affecting widely deployed enterprise platforms. VMware released fixes for serious flaws in ESX and vCenter, while Fortinet confirmed active exploitation of vulnerabilities in FortiOS and VeloCloud Orchestrator. Google patched 370 security issues in Chrome, and a data-conversion library fastjson was found vulnerable with observed attacks. Apple shipped iOS 26.6 and iPadOS 26.6 containing fixes for 87 vulnerabilities, and Cisco warned that its Firewall Management Center is already being exploited. Additional patches addressed OpenAM, Node.js, and a critical flaw dubbed KindaRails2Shell in Ruby on Rails. The list also includes a breach at an ANA Group e-commerce site that may have exposed customer data.