CVE-2026-111497

🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497 Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder. ⠀ An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server. ⠀ Affected: • Node.js 22.x • Node.js 24.x • Node.js 26.x Fixed: • Node.js 22.23.4 • Node.js 24.22.1 • Node.js 26.12.1 ⠀ End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates. Administrators should upgrade and restart affected services. Source: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

This week has been quite a shitshow already, and there are still 2 days to go Here’s a quick recap of the security mess we’ve seen in just the last few days: 1. PHP Core RCE (CVSS 9.2) Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great… Useful links: Official PHP advisory and patches: https://www.php.net/archive/2026.php#2026-10-21-5 Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/ Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI: https://www.wiz.io/blog/php2shell-php-rce Corelight’s open-source Zeek and Suricata detection rules: https://github.com/corelight/php2shell-detect 2. GitLab RCE (CVSS 10.0) CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases. https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/ 3. Node.js / Brotli RCE CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases 4. DNS-over-QUIC DoS CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers. https://www.nlnetlabs.nl/projects/unbound/security-advisories/ 5. eMudhra CA disaster And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct. Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server. Google’s analysis and response: https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/ Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 — And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research. We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years. I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects. The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control. Anyway, quite a week. And it’s only Thursday…

你，是一个普普通通平平无奇的运维 今天中午你刚休息完，拿着一杯咖啡坐回了自己的工位上 想象一下你司架构是 nginx(CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-95101, CVE-2026-97629) 反向代理，后面挂着 PHP 8.1(CVE-2026-109618, CVE-2026-109619) 主站、Node.js 24.x(CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074) Brotli 网关、Go(CVE-2026-111943) 微服务、Rust TLS 校验层(RUSTSEC-2026-0382, CVE-2026-111943) 、Python + LiteLLM 1.107.0 AI 中台，全部跑在 Linux 内核 c6e50df8 之前，HTTPS 证书由 eMudhra 签发并通过 emSign 交叉认证，根证书库用 Go(CVE-2026-111943) crypto/x509 + Rust(RUSTSEC-2026-0382, CVE-2026-111943) webpki-roots + Python certifi，CI 昨晚刚从 PyPI(LiteLLM 1.107.0被投毒) 拉了新包 而你，是这个网站的唯一运维

🚨近 48 小时网络安全事件 · PHP2Shell PHP 5.4 及以后的版本有两个不用登录就能远程执行代码的漏洞，已经被大范围利用。10 月 21 日晚发了补丁，但 8.1 及更早的版本官方不再提供修复升级。 · GitLab CVE-2026-110264 自建的 GitLab 从 7.0 版本起都受影响，正则引擎有整数溢出，CVSS 评分是满分 10 分，不用登录就能远程执行代码。最新补丁是 19.5.1。 · LiteLLM 1.107.0 被投毒 发布流水线被攻破，恶意版本在 PyPI 上挂了大约 1 小时 44 分钟。装上后一启动 Python 就会偷走 SSH、云服务和 AI 工具的凭据，还会装后门。官方建议退回 1.106.2 并轮换所有密钥。 · Node.js 的 Brotli 解码器越界写入 22、24、26 三条版本线一共修了 10 个漏洞。最严重的是 Brotli 解码器越界写入（CVE-2026-111497），可能导致远程执行代码。 · eMudhra 中间 CA 私钥可被算出 这家印度证书机构有 8 把中间证书私钥的值小于 256，任何人都能用它伪造证书。Chrome、Firefox 和 Apple 已经封禁了这些证书。 · Railway 环境变量泄露 托管平台 Railway 被人访问了加密的环境变量，其中一部分已经被解密。部署已暂停，官方要求所有用户轮换密钥。 · Agent2Shell 研究者公开了一种攻击：在仓库里放一个恶意配置，Claude Code、Cursor、Codex 和 Gemini 就会在调用模型、弹出信任确认之前执行攻击者的代码。已经报给厂商，但各家在哪个版本修复还没核实。

PILNE - Administratorzy dalszy ciąg łatania! Wykryto dwie KRYTYCZNE, niezałatane luki. Tym razem w Java i NodeJS Obie RCE: CVE-2026-91403 score 9.1/10 i CVE-2026-111497 score HIGH https://t.co/YN5NPcesK6

>use brotli for the first time in an app >"wow this is pretty good! very efficient!" >next day: CVE-2026-111497

Patching many websites today.... PHP and Node.js. CVE-2026-109618 CVE-2026-109619 CVE-2026-111497 Take actions immediately.

Votre Node local est à jour. Celui de la CI et de la prod aussi ? Node.js a publié hier les versions 22.23.4, 24.22.1 et 26.12.1. Elles corrigent 10 CVE, dont une RCE dans le décodeur Brotli (CVE-2026-111497). La faille est exploitable lorsque votre code ou une dépendance décompresse des données Brotli contrôlées par un attaquant. Ça peut arriver avec un simple fetch : Node décompresse automatiquement les réponses Content-Encoding: br, sans appel explicite à zlib dans votre code. C’est aussi la limite de la protection déployée par Vercel. Son WAF bloque le vecteur entrant, mais ne couvre pas les réponses que vos fonctions récupèrent sur d’autres serveurs. Ces versions corrigent également deux contournements de la vérification du nom d’hôte TLS et bloquent des certificats intermédiaires compromis d’eMudhra. Ce que je vérifie : • Le Node actif en local avec which -a node et node -v, puis les autres versions utilisées par mes projets via nvm, fnm ou Homebrew. • Les images Docker : un FROM node:22 ne se met pas à jour tout seul. Il faut récupérer une base corrigée, reconstruire avec --pull et redéployer. Si un tag de version précis ou un digest est figé, il faut aussi modifier cette référence. • Les versions de Node configurées en CI, notamment dans setup-node et les fichiers .nvmrc. • Le Next.js auto-hébergé : l’optimiseur peut récupérer des images distantes. Vercel précise qu’il ne bloque pas les réponses en Brotli, ce qui rejoint le risque lié aux réponses récupérées ailleurs. • Les CLI d’agents qui utilisent le Node de la machine, notamment lorsqu’ils récupèrent du contenu web. Après l’inventaire : mettre à jour les runtimes concernés, redémarrer ou redéployer les applications, puis contrôler la version réellement utilisée et tester les parcours essentiels. Sur les runtimes gérés par Vercel, les patchs de Node 22 et 24 sont déployés par la plateforme. Pas de changement de branche à effectuer pour ces projets ; le bulletin indique que le déploiement des correctifs est en cours. Node 20 est en fin de vie et ne reçoit pas ces correctifs. Il faut passer sur une branche maintenue, y compris sur Vercel. Vous avez combien de versions de Node différentes entre votre machine, la CI et la prod ?

few hours ago @nodejs fixed 3 high-severity bugs. each hides behind something your server does every day brotli (CVE-2026-111497) > crafted compressed data makes node's decoder write outside its memory, and code can run on your server > you're concerned if you fetch urls someone else picked (webhooks, link previews, crawlers, agents) or accept compressed request bodies. fetch(), axios and got unpack replies on their own tls (CVE-2026-106069, -105483) > write an ip oddly (10.5 for 10.0.0.5) and node can accept a certificate issued for another address > you're concerned if your services call each other by ip over https dns (CVE-2026-105482) > dns.resolve() stops at the first null character. http://evil.com\http://0.trusted.com passes an "ends with .trusted.com" check, and http://evil.com gets looked up > you're concerned if you call dns.resolve() yourself to vet a domain

🎢 Jedziemy dalej... CVE-2026-91403 CVE-2026-111497 https://t.co/NnJrXNAlls

ZEIT Finance is aware of the php2shell RCE, the eMudhra (emSign) CA private key compromise, and Node.js CVE-2026-111497 & related advisories. As of this morning: • All systems and runtimes are patched, secured, and protected • All funds remain strictly non-custodial and safe • Network-level access restrictions have been tightened and audited • The Team are actively monitoring across all infrastructure Stay safe out there ZEIT

This week the internet’s core infrastructure got hit harder than most people realize. 1. PHP2Shell (CVE-2026-109618 & CVE-2026-109619) → Two critical unauthenticated RCEs in PHP core (use-after-free / OOM corruption tied to request handling and session.upload_progress) → CVSS 9.2 — fixed Oct 21 in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 after details leaked early → Exploitation attempts observed in honeypots (some before public disclosure) → Highest risk on internet-facing PHP, especially Apache mod_php 2. Node.js Brotli (CVE-2026-111497) → High-severity out-of-bounds write in the Brotli decoder that the project says permits remote code execution → Fixed Oct 21 in 22.23.4 / 24.22.1 / 26.12.1 → Triggered when decompressing untrusted Brotli data (including via fetch() or certain body parsers) → No public exploits or confirmed in-the-wild exploitation reported as of Oct 22 3. LiteLLM supply-chain (v1.107.0) → Active compromise of the release pipeline → Malicious litellm==1.107.0 (all 7 PyPI wheels + matching Docker images) was live for roughly two hours on Oct 21 → Credential stealer + remote code loader that executes on Python startup (even without importing the package) → Artifacts removed. Previous versions are safe. Stolen credentials were observed being used 4. eMudhra intermediate CA keys → Eight intermediate CA private keys generated with extremely weak entropy (some single-byte or tiny integers) and recoverable in seconds → Key-generation ceremony flaw from April 2025 — not a root-key compromise or infrastructure breach → Browsers blocked them starting around Oct 17–20. Non-browser TLS clients and system trust stores still need updates 5. GitLab (CVE-2026-110264) → CVSS 10.0 unauthenticated RCE via integer overflow in the regex compiler (Onigmo) → Affects self-managed GitLab CE/EE from version 7.0. Fixed Oct 21 across multiple branches (including 18.11.13 and the 19.x series) → Requires specific conditions. gitlabdotcom was already updated 6. PwnEscape (CVE-2026-99999) → Guest-to-host escape through the Linux host’s IPv4 networking stack (checksum offload metadata), not a bug in KVM itself → CVSS 9.3 → Memory leak demonstrated against production sandboxes; full RCE shown in lab environments → Kernel patches available Independent issues that surfaced in the same news cycle (multiple projects shipped security releases around Oct 21; PHP’s was accelerated by a leak). If you’re exposed, move now: PHP (anything public) → LiteLLM (rotate secrets if you installed 1.107.0 or pulled affected Docker tags) → GitLab self-managed → Node.js (if processing untrusted Brotli) → trust stores and kernel (if running untrusted guests) Most teams will miss at least one of these. Don’t be one of them.

Fresh Node.js + React/Next.js security fixes: Node Brotli RCE (CVE-2026-111497): 22.23.4 / 24.22.1 / 26.12.1 Next.js: 2 critical RCEs + Server Actions DoS → 15.5.28 / 16.4.1 Check your deployed versions. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases https://nextjs.org/blog/nextjs-security-update-october-14-2026

A stranger's server corrupts memory inside your Node.js app with one malformed compressed reply to fetch(). CVE-2026-111497 hits every supported Node.js line. Express 5 uploads reach the same Brotli bug. Update to 22.23.4, 24.22.1 or 26.12.1. https://hol.org/blog/cve-2026-111497-nodejs-brotli-decoder-out-of-bounds-write https://t.co/opXtwF0lMc

天黑了请闭眼，狼人请睁眼🐺👀 对余弦 @evilcos 老师提到的几起泄漏、漏洞事件进行了梳理 1. PHP2Shell（CVE-2026-109618 / CVE-2026-109619） 严重程度：两项均为 CVSS v4 9.2（部分机构评为10.0） 影响：PHP 核心漏洞，攻击者无需登录即可远程执行代码（Unauthenticated RCE），部分场景可在应用代码运行前触发。影响 PHP 5.4 及之后的多个版本（官方已为 8.2–8.5 发布修复，旧版本有源码回移或需自行处理）。 进展：细节提前泄露，PHP 于 10 月 21 日紧急发布修复版本（8.5.12、8.4.27、8.3.36、8.2.35 等）。Cloudflare、watchTowr 等已观察到早期攻击尝试。多国政府网站临时下线或建议“拔网线”。 应对：尽快升级并重启 PHP 工作进程。旧版本需确认发行版是否已回移补丁。 2. eMudhra CA 私钥泄露 事件：印度证书颁发机构 eMudhra 的 8 个中间 CA 私钥因生成时随机性不足（部分私钥强度极低，甚至只有个位数），被安全研究员轻易恢复。 影响：持有这些私钥可签发被浏览器信任的任意网站证书，存在中间人攻击风险；另有 2 个代码签名证书受影响。 进展：10 月 17 日报告后，Chrome、Firefox、Apple、Microsoft 等迅速封锁相关证书，eMudhra 已撤销。暂未在 CT 日志中发现已被滥用的证据。印度 CERT-In 已发警告。 应对：浏览器已自动处理；自建信任库、IoT 设备或未及时更新的系统需检查并更新。 3. GitLab CVSS 10 漏洞（CVE-2026-110264） 严重程度：CVSS 10.0 影响：自管 GitLab（CE/EE）上，特定条件下（如处理精心构造的 Org-mode 文件或正则）可实现未认证远程代码执行。影响范围可追溯至较早版本。 进展：10 月 21 日发布修复版本（19.5.1、19.4.3、19.3.6、19.2.9 等，含多个回移）。此前 10 月 12 日还有另一项相关 CVSS 10 漏洞（CVE-2026-97229），已打过补丁的实例仍需再次更新。 应对：自管实例立即升级到对应分支的修复版本。http://GitLab.com 已修复。 4. LiteLLM 供应链投毒（v1.107.0） 事件：10 月 21 日，LiteLLM 发布管道被入侵，恶意版本 1.107.0 被推送到 PyPI 和 Docker Hub（含 latest 等标签），存活约 2 小时后被下架。 影响：恶意包包含凭据窃取器和远程代码执行能力，启动时自动执行，可窃取云密钥、AI API 密钥、SSH 密钥、浏览器数据、LiteLLM 数据库凭据等。 应对：避免使用 1.107.0，回退或锁定到 1.106.2。若已安装，需重建环境并轮换所有可能暴露的凭据。企业私有版本未受影响。 5. Node.js 高危漏洞更新 内容：10 月 21 日针对 26.x、24.x、22.x 发布安全更新，修复 10 项漏洞（其中 4 项高危）。 重点：包括 Brotli 解码器越界写入可能导致的远程代码执行（CVE-2026-111497），以及多项 TLS 主机名验证绕过和 DNS 问题。同时更新了内置证书库以应对 eMudhra 事件。 修复版本：26.12.1、24.22.1、22.23.4。 应对：尽快升级对应分支。

🚨GoPlus安全警报：Node.js 发布 2026 年 10 月安全更新 Node.js 官方于 10 月 21 日修复 10 项漏洞：4 项高危、3 项中危、3 项低危。其中，CVE-2026-111497 为 Brotli 解码器越界写，在应用处理不可信压缩数据时可能导致远程代码执行。其余高危问题涉及 dns.resolve 对含 NUL 字符域名的截断，以及两项 TLS 证书主机名校验绕过。中低危问题还涉及 Keep-alive 响应处理、随机值重复、ZIP 文件处理和权限模型等。 修复版本：Node.js 22.23.4、24.22.1、26.12.1。 各漏洞适用分支不同，不能仅凭使用 Node.js 就认定存在可利用入口。 https://nodejs.org/en/blog/vulnerability/october-2026-security-releases ⚠️ 安全自查与处置 1、明确运行版本： 盘点服务、节点和容器中实际运行的 Node.js 可执行文件及镜像来源，核对所有副本；本机执行 node -v 的结果不一定是业务进程使用的版本。 2、按暴露面优先升级： 优先处理会解码外部 Brotli 数据，或使用不可信输入构造 DNS、HTTPS/TLS 目标的服务。升级至对应分支的修复版或经核实的供应商回补版本，并完成重启及多节点复核。 3、暂无法升级时收紧入口： 限制不可信压缩数据和可控连接目标，检查已有解码错误、进程异常及证书告警。这些措施不能替代运行时更新。

What a week! 😅 Node.js security updates are out for 22.x, 24.x & 26.x Fixes multiple high-severity issues, including a Brotli decoder RCE (CVE-2026-111497) and TLS hostname bypasses. Update your systems now: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases #NodeJS #CyberSecurity

Forget PHP, if you are running any Agent harness you need to patch Node! Node.js released emergency security updates on October 21, 2026, addressing TEN vulnerabilities, including four high-severity issues such as an RCE flaw in the Brotli decoder (CVE-2026-111497) and TLS certificate verification bypasses. Update immediately to Node.js 22.23.4, 24.22.1, or 26.12.1. [1, 2, 3, 4] October 2026 Vulnerability Highlights •Remote Code Execution (RCE): A flaw in the Brotli compression algorithm decoder allows remote code execution. [1, 2] •TLS Security Bypasses: Two separate flaws can trick apps into accepting invalid or mismatched server certificates. [1, 2] •DNS Resolution: A high-severity issue impacts DNS name resolution handling. [1] • Affected and Patched Versions •Node.js 22.x: Update to 22.23.4 •Node.js 24.x: Update to (https://nodejs.org) •Node.js 26.x: Update to 26.12.1 •End-of-Life Versions (18.x and 20.x): No official patches are available; you must upgrade to a supported release line. [1, 2, 3, 4]

Node's Brotli RCE (CVE-2026-111497) bites when your code or a library decodes attacker-controlled Brotli. A WAF can catch inbound bodies, not responses you fetch: crawlers, webhooks, link previews, agents with web tools. Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node 20 has no fix.

@embw_l0x yeah, veggies, here it is: One fixes a high-severity Brotli decoder flaw that can permit remote code execution (CVE-2026-111497)