22 matches found
Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)
Brocade Security has become aware of Node2Shell also known as CVE-2026-111497, HTTP2Shell, or Broccoli2Shell. A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer. An invalid block switch was reported as a temporar...
Exploit for Unchecked Return Value in Google Brotli
node2shell-audit !CVEhttps://img.shields.io/badge/CVE-2026...
CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE...
Exploit for CVE-2026-111497
node2shell-detector Host-side detections for Node2Shell CV...
Exploit for CVE-2026-111497
CVE-2026-111497 lab RCE/DoS checker A lab-only exact-profil...
Node.js 26.5.0 Zlib Synchronous API TypedArray Denial of Service
Node.js versions 22.x, 24.x, and 26.x contain a flaw in synchronous node:zlib APIs where a spoofed TypedArray byteLength can trigger an assertion and crash the process...
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code ...
K000163272: Node.js vulnerability CVE-2026-58045
Security Advisory Description A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
nodejs: Node.js: Denial of Service vulnerability
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users...
CVE-2026-58045
A flaw was found in Node.js. A malicious actor could exploit this vulnerability by providing a specially crafted input to the synchronous node:zlib APIs. This could cause the Node.js process to crash, leading to a denial of service and making the application unavailable to users. Mitigation...
CVE-2026-58045
A flaw in Node.js allows a spoofed "TypedArray" "byteLength" to trigger a reachable assertion in the synchronous "node:zlib" APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...
CVE-2026-58045: Uncontrolled Resource Consumption
A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This...