{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:54:42.456Z",
  "tag": {
    "id": "brotli",
    "label": "Brotli",
    "isStack": false,
    "url": "https://pwn.watch/t/brotli",
    "feed": "https://pwn.watch/t/brotli/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "nodejs-october-2026-security-releases",
      "title": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases",
      "json": "https://pwn.watch/i/nodejs-october-2026-security-releases.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Node.js",
      "tags": [
        "node",
        "emudhra",
        "tls",
        "rce",
        "brotli"
      ],
      "cveIds": [
        "CVE-2026-111497",
        "CVE-2026-105482",
        "CVE-2026-105483",
        "CVE-2026-106069",
        "CVE-2026-105481",
        "CVE-2026-106072",
        "CVE-2026-106074",
        "CVE-2026-106070",
        "CVE-2026-106071",
        "CVE-2026-106073"
      ],
      "affectedVersions": [
        "22.x, 24.x, 26.x (EOL lines not patched)"
      ],
      "fixedVersions": [
        "22.23.4",
        "24.22.1",
        "26.12.1"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-23T03:53:49Z",
      "summary": "On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a Brotli decoder out-of-bounds write (high per Node.js, CVSS 9.2 critical per the Google CNA on NVD, rooted in Google Brotli 1.0.3 to 1.2.0) that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Ron Masas",
      "handle": "RonMasas",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2013355514650882048/ZAmTwrHJ_bigger.jpg",
      "text": "Liked PHP2Shell? You’re gonna love Node2Shell.\n\nWe reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!",
      "date": "2026-10-22T17:06:07.000Z",
      "url": "https://x.com/RonMasas/status/2113315979405258810",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Node.js",
      "handle": "nodejs",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2087612853830258688/JUl27p1E_bigger.jpg",
      "text": "🔐 Node.js security updates are now available!\n\nNew releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.\n\nReview the details and update your systems to stay secure.\n\n🔗 https://t.co/W4kfzx5lxz\n\n#NodeJS #Security",
      "date": "2026-10-21T22:39:27.000Z",
      "url": "https://x.com/nodejs/status/2113037478286221570",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Mark Gadala-Maria",
      "handle": "markgadala",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg",
      "text": "🚨 BREAKING: Node.js just dropped its OWN security bombshell.\n\n4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.\n\n→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated https://t.co/k3Vb8WK1eC",
      "date": "2026-10-21T17:11:48.000Z",
      "url": "https://x.com/markgadala/status/2112955022082207978",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Daily CyberSecurity",
      "handle": "Daily_CyberSec",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg",
      "text": "The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.\n\n#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity\nhttps://t.co/2Rmy6FPWq0",
      "date": "2026-10-21T15:49:04.000Z",
      "url": "https://x.com/Daily_CyberSec/status/2112934202412826673",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "5h3ll",
      "handle": "social5h3ll",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098744719451037699/D5xMv_cH_bigger.jpg",
      "text": "Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! \n\nSecurity updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.\n\nHighest severity is HIGH. Key issues include:\n•  TLS non-canonical IP address handling (CVE-2026-106069 / https://t.co/npxfOdxGdg",
      "date": "2026-10-21T12:03:43.000Z",
      "url": "https://x.com/social5h3ll/status/2112877488456044609",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVJy39RW8AApYfx.jpg"
        }
      ],
      "incident": "nodejs-october-2026-security-releases"
    }
  ],
  "changes": [
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too.",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Researcher Ron Masas says his team reproduced CVE-2026-111497 as a pre-auth RCE on a vulnerable Node.js runtime, with app.use(express.json()) enough to expose a server through a single Brotli request.",
      "body": null,
      "sourceUrl": "https://x.com/RonMasas/status/2113315979405258810",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Node.js published the Wednesday security releases and advisory.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    }
  ]
}