Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. References: https://github.com/assetnote/node2shell-scanner https://www.slcyber.io/exposure https://nvd.nist.gov/vuln/detail/CVE-2026-111497 Remediation: Update to version 1.0.10, 1.1.1, 1.2.1 or latest available version.
Used 20 times · 10 assets checked · domain, subdomain, ipv4