✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

PHP Releases Emergency Updates for Critical PHP2Shell Vulnerabilities

October 22, 2026
Rewterz

PHP2Shell Vulnerabilities Pose Emerging Threat to Internet-Facing Systems – Active IOCs

October 23, 2026

Node.js Patches Critical Brotli RCE Vulnerability and Multiple Security Flaws

Severity

High

Analysis Summary

Node.js released security updates on October 21, 2026, for its supported 22.x, 24.x, and 26.x release lines, addressing 10 vulnerabilities, including a high-severity remote code execution (RCE) flaw in the bundled Brotli decompression library.

The most serious vulnerability, CVE-2026-111497, is an out-of-bounds write triggered by malformed Brotli-compressed input. It may allow attackers to execute arbitrary code when an application decompresses attacker-controlled data through the node:zlib module or processes Brotli-compressed responses using fetch(). A public proof-of-concept published on October 22 achieved code execution only in a deliberately weakened test build. Testing against a standard Node.js build reportedly resulted in a crash and limited memory disclosure rather than code execution. No exploitation in the wild had been reported as of October 22.

The other vulnerabilities include TLS certificate hostname-validation bypasses, DNS hostname truncation involving null bytes, insecure random-value generation in startup snapshots and single-executable applications, HTTP keep-alive processing issues, and weaknesses in the Permission Model and ZIP file handling. The updates also address certificate validation issues and refresh bundled dependencies, including undici, c-ares, OpenSSL, and SQLite.

The releases additionally block eight reportedly compromised intermediate certificate authority keys associated with Indian provider eMudhra and remove three emSign root certificates. However, existing connections established before the update may not be revalidated until their sessions expire.

Affected versions and fixed releases:

  • Node.js 22.x: Upgrade to 22.23.4.
  • Node.js 24.x: Upgrade to 24.22.1.
  • Node.js 26.x: Upgrade to 26.12.1.
  • Node.js 20.x and earlier: Upgrade to a supported release line, as these versions are end-of-life and will not receive the fixes.

Organizations should prioritize upgrading affected Node.js deployments, particularly applications that process untrusted compressed data. No temporary workaround is available for the Brotli vulnerability. Firewall rules may provide limited protection for inbound requests but do not cover all attack scenarios and cannot replace applying the security updates.

Impact

  • Denial of Service
  • Buffer Overflow
  • Remote Code Execution

Indicators of Compromise

CVE

  • CVE-2026-111497
  • CVE-2026-106069
  • CVE-2026-105483
  • CVE-2026-105482
  • CVE-2026-105481
  • CVE-2026-106072
  • CVE-2026-106074
  • CVE-2026-106070
  • CVE-2026-106071
  • CVE-2026-106073

Remediation

  • Upgrade Node.js 22.x to version 22.23.4, 24.x to 24.22.1, or 26.x to 26.12.1 to address the reported vulnerabilities.
  • Upgrade Node.js 20.x and earlier to a supported release line, as these versions are end-of-life and will not receive the security fixes.
  • Update all applications and services that bundle or depend on vulnerable Brotli libraries to patched versions.
  • Validate and sanitize untrusted compressed input before decompression to reduce exposure to malformed Brotli data.
  • Review TLS certificate validation and hostname verification configurations to prevent certificate-check bypasses.
  • Update DNS resolution and hostname-handling components to prevent null-byte hostname manipulation.
  • Review applications using crypto.randomUUID() and crypto.randomInt() in startup snapshots or single-executable builds, and ensure generated values are unpredictable.
  • Update Node.js dependencies, including undici, c-ares, OpenSSL, and SQLite, to versions containing the relevant security fixes.
  • Review Node.js Permission Model configurations and restrict filesystem access to authorized paths.
  • Re-establish or restart existing TLS connections after patching to ensure certificate validation reflects the updated trust configuration.
  • Apply available firewall rules to block known attack patterns against inbound requests while prioritizing the Node.js upgrade.
  • Monitor application logs and network traffic for suspicious requests, unexpected crashes, memory anomalies, and potential exploitation attempts.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo