Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Oct 26, 2026

Node.js Brotli Request-Body Integer Overflow (node2shell) - Remote Code Execution

Est. Time~10 seconds
Scan TypeSingle Scan
Targetsdomain, subdomain, ipv4
CostFree
20
Times Used
continuous scan runs
10
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
9.2
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Brotliby Google
AFFECTED< 1.0.10→SAFE ✓≥ 1.0.10
Cloud Connector Configuratorby Siemens
AFFECTED< V1.24.3→SAFE ✓≥ V1.24.3
Common Configurator (CC on IEM)by Siemens
AFFECTED< *→SAFE ✓≥ *
Common Configurator on Device (CC on Edge)by Siemens
AFFECTED< *→SAFE ✓≥ *
Updated Nov 10, 2026View on NVD →

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

Browse All Tools