CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Am I affected?
Sign in and add the software you use to your watchlist: we check it against every new vulnerability.
Show me how to fix itTimeline
- Published by NVD
- First covered by RedTeamDaily
- Last updated by NVD
Coverage
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.
Sources: NVD and CISA known exploited vulnerabilities catalogue.