Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in
Vulnerability

CVE-2026-105483

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`). `tls.checkServerIdentity()` did not recognize such hosts as IP addresses, even though they normalize and resolve to a regular IPv4 address, and matched them against the certificate DNS names and Common Name instead. A certificate containing `DNS:127.0.0.1` or `DNS:*.0.0.1` could therefore be accepted for an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. This vulnerability affects Node.js **26.x** and **24.x**.

CVSS score (v3.0)7.4High
Not on CISA KEV list

Am I affected?

Sign in and add the software you use to your watchlist: we check it against every new vulnerability.

Show me how to fix it

Timeline

  1. Published by NVD
  2. First covered by RedTeamDaily
  3. Last updated by NVD

Coverage

CSO Online· · Critical

Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV

CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, , Envoy Proxy, Istio and Python packages, may be affected.

Am I affected?
Ask
5
Qualys Threat Research· · Critical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google , CVSS 9.2) and CVE-2026-48356 ( Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, and Microsoft .NET have released fixes for Brotli.

Am I affected?
Ask
9

Sources: NVD and CISA known exploited vulnerabilities catalogue.