Live monitoring Updated 72-hour alert levelPriority Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

CVE entry · CVE-2026-111497

CVE-2026-111497: A Node.js flaw lets attackers hack apps with nothing more than compressed data

Node.js fixed this flaw in its Brotli decoder on October 21. Imperva exploited it in testing to run code. Here are the versions to install and the applications most at risk.

Our analyses

Alerts and vulnerabilities from CERT Santé, the French healthcare CERT

  1. CVSS 8.1

    Node.js - CVE-2026-111497

    Patch available

What to do

  1. Check whether your estate includes the affected product, including internet-facing devices.
  2. Apply the vendor’s patch or mitigations (references below).
  3. Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References