Node.js: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Critical 9.2
  CVE-2026-111497 Exploited Public exploit EPSS 83%

  Out-of-Bounds Write in Google Brotli Decoder

  A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

  Google Brotli firefox open-webui Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go Hex
  Oct 22, 2026

  KEV Oct 27, 2026
• High 7.4
  CVE-2026-105482 Public exploit

  A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• High 7.4
  CVE-2026-105483 Public exploit

  A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a co…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• High 7.4
  CVE-2026-106069 Public exploit

  A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP addre…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• Medium 6.7
  CVE-2026-106072 Public exploit

  A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint whe…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• Medium 6.5
  CVE-2026-105481 Public exploit

  A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• Medium 4.8
  CVE-2026-106074 Public exploit

  A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, a…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• Medium 4.6
  CVE-2026-28330

  SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

  SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authentic…

  SolarWinds SolarWinds Observability Self-Hosted
  Oct 20, 2026
• Low 3.7
  CVE-2026-106070 Public exploit

  A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after t…

  Node.js node nodejs nodejs Ubuntu Alpine Wolfi
  Oct 23, 2026
• Low 3.6
  CVE-2026-106071 Public exploit

  A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--all…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026
• Low 3.3
  CVE-2026-106073 Public exploit

  A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permissi…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 23, 2026

Revision history

1. 2026-11-12 #17

   Neue Updates von SUSE aufgenommen

2. 2026-11-11 #16

   Neue Updates von Red Hat, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

3. 2026-11-10 #15

   Neue Updates von Red Hat und Gentoo aufgenommen

4. 2026-11-09 #14

   Neue Updates von SUSE, Apple, Red Hat, Oracle Linux, Rocky Enterprise Software Foundation und IBM aufgenommen

5. 2026-11-08 #13

   Neue Updates von Red Hat, openSUSE und SUSE aufgenommen

6. 2026-11-05 #12

   Neue Updates von Google, Devolutions, Synology, SUSE und Red Hat aufgenommen

7. 2026-11-04 #11

   Neue Updates von SUSE, Oracle Linux, Red Hat und Citrix aufgenommen

8. 2026-11-03 #10

   Neue Updates von openSUSE, Red Hat, Elastic und SUSE aufgenommen

9. 2026-11-02 #9

   Neue Updates von Red Hat, Fedora, SUSE und IGEL aufgenommen

10. 2026-11-01 #8

    Neue Updates von Oracle Linux, SUSE, Red Hat, HCL und Ubuntu aufgenommen

11. 2026-10-29 #7

    Neue Updates von Red Hat, SUSE, Rocky Enterprise Software Foundation und Ubuntu aufgenommen

12. 2026-10-28 #6

    Neue Updates von Splunk-SVD und Red Hat aufgenommen

13. 2026-10-27 #5

    Exploit aufgenommen CVE-2026-111497, Bewertung angepasst

14. 2026-10-26 #4

    Neue Updates von Oracle Linux, Red Hat, Fedora und Ubuntu aufgenommen

15. 2026-10-25 #3

    Neue Updates von Fedora und Debian aufgenommen

16. 2026-10-22 #2

    PoC aufgenommen CVE-2026-111497 ("Node2Shell")

17. 2026-10-21 #1

    Initiale Fassung

References

• Node.js Security Release vom 2026-10-21
  https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• Node.js Security Release vom 2026-10-21
  https://nodejs.org/en/blog/release/v22.23.4
• Node.js Security Release vom 2026-10-21
  https://nodejs.org/en/blog/release/v24.22.1
• Node.js Security Release vom 2026-10-21
  https://nodejs.org/en/blog/release/v26.12.1
• PoC CVE-2026-111497 Node2Shell
  https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
• Red Hat Security Advisory RHSA-2026:87420 vom 2026-10-23
  https://access.redhat.com/errata/RHSA-2026:87420
• Fedora Security Advisory FEDORA-2026-A336A99528 vom 2026-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-a336a99528
• Debian Security Advisory DLA-4855 vom 2026-10-24
  https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html
• Debian Security Advisory DSA-6582 vom 2026-10-24
  https://security-tracker.debian.org/tracker/DSA-6582-1
• Fedora Security Advisory FEDORA-2026-5B98DD6D78 vom 2026-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-5b98dd6d78
• Microsoft Security Update Guide
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
• Oracle Linux Security Advisory ELSA-2026-500514 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500514.html
• Red Hat Security Advisory RHSA-2026:90501 vom 2026-10-26
  https://access.redhat.com/errata/RHSA-2026:90501
• Fedora Security Advisory FEDORA-2026-4AADE61415 vom 2026-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-4aade61415
• Oracle Linux Security Advisory ELSA-2026-500517 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500517.html
• Red Hat Security Advisory RHSA-2026:90495 vom 2026-10-26
  https://access.redhat.com/errata/RHSA-2026:90495
• Oracle Linux Security Advisory ELSA-2026-500515 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500515.html
• Fedora Security Advisory FEDORA-2026-92436BEF9C vom 2026-10-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-92436bef9c
• Oracle Linux Security Advisory ELSA-2026-500516 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500516.html
• Ubuntu Security Notice USN-8956-1 vom 2026-10-26
  https://ubuntu.com/security/notices/USN-8956-1
• Oracle Linux Security Advisory ELSA-2026-500513 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500513.html
• Oracle Linux Security Advisory ELSA-2026-500512 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-500512.html
• Oracle Linux Security Advisory ELSA-2026-500520 vom 2026-10-27
  https://linux.oracle.com/errata/ELSA-2026-500520.html
• Oracle Linux Security Advisory ELSA-2026-500518 vom 2026-10-26
  https://linux.oracle.com/errata/ELSA-2026-500518.html
• Red Hat Security Advisory RHSA-2026:90449 vom 2026-10-26
  https://access.redhat.com/errata/RHSA-2026:90449
• Oracle Linux Security Advisory ELSA-2026-500519 vom 2026-10-27
  https://linux.oracle.com/errata/ELSA-2026-500519.html
• Palo Alto Security Advisory
  https://security.paloaltonetworks.com/CVE-2026-111497
• Exploit CVE-2026-111497
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Red Hat Security Advisory RHSA-2026:89206 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:89206
• National Vulnerability Database CVE-2026-28330 vom 2026-10-27
  https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2026-4-1_release_notes.htm
• Red Hat Security Advisory RHSA-2026:90893 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90893
• Red Hat Security Advisory RHSA-2026:90914 vom 2026-10-27
  https://access.redhat.com/errata/RHSA-2026:90914
• VMware Security Advisory VMSA-2026-0008 vom 2026-10-28
  https://app.sw.broadcom.com/e/er?utm_content=VCF_FY26_VCF_VMSA-2026-0008_6932_SecurityAlert_MKT_TRANS_EM_14419&s=3805888&lid=15186&elqTrackId=694685E6DA8205B11F1CE8D2643AF3F4&elq=52cf0ef17e344c04a8ca0714bf95a772&elqaid=14419&elqat=1&elqak=8AF5120EAAFB11729B015FB40A016A9CD159ABE36BB05B3C2B383233A22C02602D8E
• Red Hat Security Advisory RHSA-2026:87702 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:87702
• Oracle Linux Security Advisory ELSA-2026-90449 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-90449.html
• Red Hat Security Advisory RHSA-2026:90888 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90888
• Red Hat Security Advisory RHSA-2026:90892 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90892
• Oracle Linux Security Advisory ELSA-2026-90501 vom 2026-10-27
  http://linux.oracle.com/errata/ELSA-2026-90501.html
• Red Hat Security Advisory RHSA-2026:90891 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90891
• Red Hat Security Advisory RHSA-2026:90889 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90889
• Red Hat Security Advisory RHSA-2026:90890 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:90890
• Splunk Security Advisory SVD-2026-1015 vom 2026-10-28
  https://advisory.splunk.com/advisories/SVD-2026-1015
• Red Hat Security Advisory RHSA-2026:91709 vom 2026-10-28
  https://access.redhat.com/errata/RHSA-2026:91709
• Red Hat Security Advisory RHSA-2026:91709 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:91709
• IBM Security Bulletin 7294670 vom 2026-10-29
  https://www.ibm.com/support/pages/node/7294670
• Rocky Linux Security Advisory RLSA-2026:90449 vom 2026-10-29
  https://errata.build.resf.org/RLSA-2026:90449
• Rocky Linux Security Advisory RLSA-2026:90495 vom 2026-10-29
  https://errata.build.resf.org/RLSA-2026:90495
• Red Hat Security Advisory RHSA-2026:92376 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92376
• SUSE Security Update SUSE-SU-2026:4945-1 vom 2026-10-30
  https://lists.suse.com/pipermail/sle-security-updates/2026-October/030256.html
• Rocky Linux Security Advisory RLSA-2026:92376 vom 2026-10-30
  https://errata.build.resf.org/RLSA-2026:92376
• Ubuntu Security Notice USN-8958-1 vom 2026-10-30
  https://ubuntu.com/security/notices/USN-8958-1
• Red Hat Security Advisory RHSA-2026:92378 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92378
• Broadcom Security Advisory
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445
• Rocky Linux Security Advisory RLSA-2026:92378 vom 2026-10-30
  https://errata.build.resf.org/RLSA-2026:92378
• Oracle Linux Security Advisory ELSA-2026-92378 vom 2026-11-02
  http://linux.oracle.com/errata/ELSA-2026-92378.html
• Oracle Linux Security Advisory ELSA-2026-92492 vom 2026-11-02
  http://linux.oracle.com/errata/ELSA-2026-92492.html
• Nutanix Security Advisory vom 2026-10-31
  https://download.nutanix.com/alerts/Security_Advisory_0061.pdf
• SUSE Security Update SUSE-SU-2026:4957-1 vom 2026-11-02
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030279.html
• Red Hat Security Advisory RHSA-2026:93065 vom 2026-10-31
  https://access.redhat.com/errata/RHSA-2026:93065
• Red Hat Security Advisory RHSA-2026:93065 vom 2026-10-30
  https://access.redhat.com/errata/RHSA-2026:93065
• HCL Security Bulletin vom 2026-10-30
  https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134995
• Red Hat Security Advisory RHSA-2026:93457 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93457
• Red Hat Security Advisory RHSA-2026:93456 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93456
• Ubuntu Security Notice USN-8956-2 vom 2026-10-30
  https://ubuntu.com/security/notices/USN-8956-2
• Red Hat Security Advisory RHSA-2026:93550 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93550
• Red Hat Security Advisory RHSA-2026:93455 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93455
• Red Hat Security Advisory RHSA-2026:94453 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94453
• Arista Security Advisory 0202 vom 2026-11-03
  https://www.arista.com/en/support/advisories-notices/security-advisory/24853-security-advisory-0202
• Fedora Security Advisory FEDORA-2026-094B09B38E vom 2026-11-02
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-094b09b38e
• SUSE Security Update SUSE-SU-2026:5036-1 vom 2026-11-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030308.html
• Red Hat Security Advisory RHSA-2026:94101 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94101
• Red Hat Security Advisory RHSA-2026:94457 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94457
• Anaconda Navigator Release Notes
  https://www.anaconda.com/docs/legacy/anaconda-navigator/release-notes#2-7-4
• Red Hat Security Advisory RHSA-2026:94100 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94100
• SUSE Security Update SUSE-SU-2026:5037-1 vom 2026-11-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030307.html
• Red Hat Security Advisory RHSA-2026:93987 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93987
• IGEL Security Notice ISN-2026-43 vom 2026-11-02
  https://kb.igel.com/en/security-safety/current/isn-2026-43-critical-brotli-issue-in-igel-os
• Red Hat Security Advisory RHSA-2026:93984 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93984
• Red Hat Security Advisory RHSA-2026:93980 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:93980
• Red Hat Security Advisory RHSA-2026:94108 vom 2026-11-03
  https://access.redhat.com/errata/RHSA-2026:94108