Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in
Vulnerability

CVE-2026-106070

A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When `zipEntry.modified` is read on an archive whose local header does not match its central directory, either directly or while compacting the archive, the validation error is caught but the parsed local header is left cached without a content offset. A later content read then returns attacker-controlled bytes from the start of the file instead of rejecting the archive, and CRC-32 verification still passes because the attacker controls the central directory CRC. A Node.js-based scanner can therefore approve different content from what another ZIP implementation extracts from the same archive. This vulnerability affects Node.js **26.x**.

CVSS score (v3.0)3.7Low
Not on CISA KEV list

Am I affected?

Sign in and add the software you use to your watchlist: we check it against every new vulnerability.

Show me how to fix it

Timeline

  1. Published by NVD
  2. First covered by RedTeamDaily
  3. Last updated by NVD

Coverage

CSO Online· · Critical

Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV

CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, , Envoy Proxy, Istio and Python packages, may be affected.

Am I affected?
Ask
5
Qualys Threat Research· · Critical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google , CVSS 9.2) and CVE-2026-48356 ( Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, and Microsoft .NET have released fixes for Brotli.

Am I affected?
Ask
9

Sources: NVD and CISA known exploited vulnerabilities catalogue.