Any front-end/back-end experts here? Node.js has a major vulnerability too, or is everyone too busy patching to browse the forum?
The flaw, tracked as CVE-2026-111497 and dubbed Node2Shell, is an out-of-bounds write in the Brotli decoder bundled with Node.js, scored 9.2 on CVSS v4.0, and researchers demonstrated code execution on an official Node.js 24.22.0 image. Fixes shipped on October 21 in versions 22.23.4, 24.22.1 and 26.12.1. It matters because Brotli data can reach the decoder implicitly through fetch responses and request-body parsing, so unpatched services may be exposed without obviously running decompression code.
SOURCES
- LinuxDo2026-10-28 10:24