KR — ZDNet Korea

"Threatening the Entire Server Ecosystem"... After PHP, Security Vulnerability Found in Node.js Too

SecurityOctober 27, 20262 min read

Security researchers found a serious flaw called Node2shell (CVE-2026-111497) in Node.js, a tool that lets JavaScript run on servers. The flaw comes right after a similar problem was found in PHP.

What happened

Theori, a South Korean company that tests software for security holes, confirmed the Node2shell flaw and published an emergency guide for companies. The problem is in a part of Node.js that unpacks Brotli data. Brotli is a method for squeezing data into a small size before sending it over the web. Node.js rates the risk as 'high'. An attacker does not need a login. They can send specially built Brotli data to crash a server, read parts of its memory, or take control of it by running their own code.

Key facts

Flaw ID: CVE-2026-111497, named Node2shell
Affected versions: Node.js 22.x, 24.x, and 26.x lines that do not have the latest security patch
Fixed versions: 22.23.4, 24.22.1, and 26.12.1 or newer
Node 20 and older no longer get official support, so users must check with their operating system or support vendor for updates
Theori also opened a free online check at nodejsguard.io that needs only a live service URL

Why Node.js matters

Node.js lets developers run JavaScript on a server, not just in a web browser. It is widely used for websites and cloud services. The flaw is not caused by a mistake in a developer's own code. It comes from the Node.js version itself. Common tools such as the Express 5 body-parser, the built-in fetch() method, and popular HTTP libraries like axios, got, and node-fetch can open the path for an attack.

Why it matters

Many websites and apps run on Node.js, so one flaw can affect a large part of the server world. Even a team that never uses compression can be exposed, because web frameworks handle this data automatically. Companies that cannot update Node.js right away need temporary protection, such as a reverse proxy like Nginx, to block attacks until they can patch.

What to watch

Whether companies install the fixed Node.js versions quickly
Whether more attacks using Node2shell are reported
Whether Node 20 and older users receive security updates from their vendors
More details from Theori's technical blog about how to check if a system was already attacked

Glossary

Node.js: A tool that lets developers run JavaScript code on a server instead of only in a web browser.
Brotli: A data squeezing method that makes files smaller so they can be sent faster over the web.
Theori: A South Korean company that uses AI to find security holes by testing systems like an attacker would.
CVE: A standard ID number that names a known security flaw so people can talk about it clearly.
Express 5: A popular framework for building web servers with Node.js.

LiteLLM supply chain attack started with an exposed master key

LiteLLM traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, which was not revoked after the commit was removed. The attacker used the key to access the company's AI agent platform and steal a GitHub CLI OAuth token, gaining owner-level access to its GitHub repositories. A poisoned version (1.107.0) of the package, which contained an infostealer and a remote access trojan, was available on PyPI for under two hours and was downloaded about 49,000 times, according to Wiz.

SecurityITmediaOct 27

Bandai Namco Logistics Subsidiary Hit by Unauthorized Access, Possible Leak of "Ichiban Kuji ONLINE" Delivery Data

Bandai Namco Holdings announced on October 26 that unauthorized access to a system managed by its logistics subsidiary Bandai Logipal may have leaked delivery information for "Ichiban Kuji ONLINE." The possibly exposed data includes names, addresses, and phone numbers, and no credit card information is included; the number of affected people is still under investigation, and no misuse has been confirmed so far. The company has reported the incident to the police and the Personal Information Protection Commission and urged potentially affected individuals to be wary of suspicious calls or mail.

Securityheise onlineOct 27

Cloudflare CEO Expects Many More Flaws Like php2shell

Cloudflare CEO Matthew Prince told Reuters that the recently disclosed php2shell and Broccoli2Shell vulnerabilities are only the beginning, and that for years weekly alarms like these may occur as more people use AI to search for security flaws. He said Cloudflare knows of several other serious vulnerabilities in critical software components but did not name the affected projects. Security firms such as VulnCheck and secuvera also expect the time between vulnerability discovery and attacks to keep shrinking.

SecurityThe RegisterOct 27

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.