FORTINET Security Advisory
Published Date: Not specified
CVE: CVE-2026-111497
Advisory Summary
🔔 🚨 Multiple Node.js CVEs (Up to CVSS 9.8) — RCE Risk Across Node 22/24/26
Fortinet PSIRT reports a set of Node.js vulnerabilities affecting Node.js 26.x, 24.x, and 22.x, including multiple high-severity issues (overall max CVSSv3 = 9.8) and one critical-style RCE vector tied to the Brotli decoder.
- CVE-2026-111497 (High, RCE-capable): Node.js issue where a Brotli decoder out-of-bounds write can enable remote code execution.
- Other High CVEs:
- CVE-2026-105482 (High): Affects 26.x / 24.x / 22.x
- CVE-2026-105483 (High): Affects 26.x / 24.x
- CVE-2026-106069 (High): Affects 26.x / 24.x / 22.x
- Medium/Low CVEs also present across the same Node.js major lines (26.x/24.x/22.x), increasing the likelihood of compounded risk for apps with multiple dependent components.
- External exposure amplification: If any of your Node services are internet-facing (APIs, gateways, SSR apps), the RCE-class risk becomes immediately relevant.
- Supply-chain & runtime sprawl: Modern stacks often run multiple Node versions across CI/CD, build agents, serverless functions, and edge services—making “partial patching” common.
- Fast exploitability potential: RCE-adjacent decoder flaws (Brotli) can be exploited via crafted inputs—especially in services that process compressed payloads.
- Restrict inbound access to Node services
- Add WAF/IPS policies for suspicious payloads (especially where Brotli/encoding is used)
🧷
-2026-111497
Reference: Vendor Advisory