Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in
Vulnerability

CVE-2026-105481

A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an incomplete fix of CVE-2026-48931. The guard that destroys idle keep-alive sockets when unexpected data arrives only runs when the event loop polls for I/O. If an unsolicited response has already reached the socket but has not been read yet when the socket is handed to a new request, for example because the event loop was busy with synchronous work, the guard is removed without seeing it and the data is parsed as the response to the new request. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

CVSS score (v3.0)6.5Medium
Not on CISA KEV list

Am I affected?

Sign in and add the software you use to your watchlist: we check it against every new vulnerability.

Show me how to fix it

Timeline

  1. Published by NVD
  2. First covered by RedTeamDaily
  3. Last updated by NVD

Coverage

CSO Online· · Critical

Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV

CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, , Envoy Proxy, Istio and Python packages, may be affected.

Am I affected?
Ask
5
Qualys Threat Research· · Critical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google , CVSS 9.2) and CVE-2026-48356 ( Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, and Microsoft .NET have released fixes for Brotli.

Am I affected?
Ask
9

Sources: NVD and CISA known exploited vulnerabilities catalogue.