#nodejs_1
-
CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores
CISA has confirmed active exploitation of two critical vulnerabilities, one in Adobe Commerce and Magento and one in Google's Brotli decoder library. The first has already been used to breach hundreds of online stores, and the second has prompted emergency updates from dozens of vendors.
-
Node2Shell: Crafted Brotli Data Runs Attacker Code on an Official Node.js Build
Imperva researchers showed that an application on an official Node.js build can be made to run attacker-supplied code by feeding it a crafted Brotli stream (CVE-2026-111497). Node.js shipped fixes on October 21.
-
Node.js Brotli Decoder Flaw Threatens Remote Code Execution Across All Supported Versions
On October 21 Node.js shipped updates for its three supported release lines, fixing 10 flaws. The most serious is a bug in the bundled Brotli decompression code that the project says could allow remote code execution.