Node.js
ProductVulnerabilities
1 CVE in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-111497 Exploited added to KEV 27 Oct
Am I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-111497 before 22.23.4 · fixed in 22.23.4
- CVE-2026-111497 from 23.0.0, before 24.22.1 · fixed in 24.22.1
- CVE-2026-111497 from 25.0.0, before 26.12.1 · fixed in 26.12.1
End of support
- Node.js 22: security updates ends 30 April 2027 (vendor)
Security timeline
- Activity reported by Dark ReadingGrey market relay service disables OpenAI Codex and Claude Code sandboxes and reroutes enterprise data
- Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news
October 2026 roundup lists cyberattacks on Binance, PHP, Node.js, LiteLLM and the Pentagon
A roundup of October 2026 security incidents covers a cryptocurrency platform, developer infrastructure, certificate authorities, government records, gaming accounts and retail operations. The headline names Binance, PHP, Node.js, LiteLLM and the Pentagon, but the excerpt is truncated and gives no details of the attacks. The article notes that confirmed breaches, malicious releases, vulnerable configurations and possible credential exposure need separate handling.
Grey market relay service disables OpenAI Codex and Claude Code sandboxes and reroutes enterprise data
Symantec's Threat Hunter Team identified a relay service active since at least early 2026 that has touched about a dozen organisations, mostly in mainland China. Users install the genuine Codex or Claude Code tool, then run a fileless setup script from a lookalike domain that rewrites the config to point at relay servers, stores the relay key as a user-level variable, sets sandbox mode to danger-full-access, enables network access and turns off telemetry. This is not a flaw in either product, but the relay can see every prompt, file and secret and could alter replies to run commands with the user's rights. No such abuse was observed.
Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google Brotli decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, Bun, Envoy Proxy, Istio and Python packages, may be affected.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.