CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Bun

product · product:bun

Coverage
1
first 2026-10-24 → last 2026-10-28
Latest activity
2026-10-28
Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0; update now
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
21
16 hosts

Action items (3)

Do-now tasks recorded on the entries about Bun, newest first. Check the date before acting on an older one.

  • Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images (a Dockerfile that pins 24.22.0 keeps the flaw until the pin changes), and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; judge a Node.js build by its release version, because process.versions.brotli reads 1.2.0 on patched builds too, and move any application on an end-of-life Node.js line to a supported release.
    2026-10-24CVE-2026-111497
  • Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable.
    2026-10-24CVE-2026-111497
  • On every PA-Series and VM-Series firewall on PAN-OS 12.2, 12.1 or 11.2 that has TLS decryption enabled, run show system setting brotli and, where it returns Enabled: yes, run set system setting brotli-encoding disable until the hotfix for the release is installed; 12.1.4-h13, 12.1.10-h3 and 11.2.4-h23 are still due, on 2026-10-29 and 2026-10-30.
    2026-10-24CVE-2026-111497

Defender insights

What each entry about Bun tells a defender to do, newest first.

2026-10-24HIGHexploitedNode2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0; update now

Exposure · detection

Story timeline

  1. 2026-10-24CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)
    trending-vulnerabilitiesNode2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0; update now

Hunting pivots

CVEs (exploited first)
CVE-2026-111497
Releases covered
Bun
Tags
actively-exploitedcisa-kevpatch-availablepoc-publicpre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi · ATT&CK page ↗

Entries about Bun (1)

2026-10-24 · view entry permalink →

HIGHCVE-2026-111497exploitedupdatedNATOA1

CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)

Node.js shipped security releases on 2026-10-21 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles: an invalid block switch was reported as a need for more input instead of a format error, so the streaming decoder kept appending input to an eight-byte internal buffer (Node.js project, 2026-10-21). An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution (Node.js project, 2026-10-21). Imperva ran code carried in Brotli data against the official 24.22.0 image in its laboratory, through fetch() and through Express 5 and body-parser 2 request parsers, and the fixed 24.22.1 rejected the same input (Imperva, 2026-10-22).

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", naming no actor or victim (CISA, 2026-10-27). The only first-hand attack telemetry found is ELLIO's: on 2026-10-26 its sensors recorded one Brotli-coded request body of about 23 MB built against Node.js 24.22.0 on x86-64, which it reads as adoption by an operator focused on mass exploitation, although the chain got no shell against ELLIO's own copy of that build in 50 attempts (ELLIO, 2026-10-26). Tenable relays the report without confirming it, and Cisco and Palo Alto say they know of no malicious use against their own products (Tenable, 2026-10-26; Cisco PSIRT, 2026-10-27; Palo Alto Networks, 2026-10-28).

Fixes are in Node.js 22.23.4, 24.22.1 and 26.12.1; end-of-life lines are always affected, and because Node.js cherry-picked the fix without bumping the bundled version string, process.versions.brotli reads 1.2.0 on patched and vulnerable builds alike (Node.js project, 2026-10-21; ELLIO, 2026-10-26). The decoder is Google's, so Bun (fixed in 1.4.4), Istio, the PyPI packages Brotli (fixed in 1.2.1) and brotlicffi (1.2.1.0), Envoy and Microsoft .NET carry the flaw too (ELLIO, 2026-10-26; Tenable, 2026-10-26; OpenSourceMalware, 2026-10-23; Envoy, 2026-10-23; .NET Blog, 2026-10-25).

A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.

Node.js project 2026-10-21

Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image.

Imperva Threat Research 2026-10-22

Proof of Concept Available

NCSC Switzerland (BACS, Cyber Security Hub advisory 13105) 2026-10-26

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls that have inspection of Brotli compressed traffic and TLS/SSL decryption enabled on the dataplane.

Palo Alto Networks PSIRT (CVE-2026-111497 portfolio status) 2026-10-26

In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.

PHP (news archive, updated Windows builds for the Brotli fix) 2026-10-26

Envoy deployments that have Brotli decompressor configured.

Envoy Proxy (security advisory) 2026-10-23

based on evidence of active exploitation

CISA (alert, KEV additions) 2026-10-27

ELLIO sensors have recorded CVE-2026-111497 exploit traffic in the wild

the attacker's chain scored zero hits in 50 attempts

ELLIO Threat Research Lab 2026-10-26

Tenable has not independently confirmed this activity.

Tenable Research 2026-10-26

The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.

Cisco PSIRT (advisory, Vulnerabilities in node.js Affecting Cisco Products) 2026-10-27

A single HTTP request containing a crafted 23 MB body crashed the tested ClickHouse server.

JFrog Security Research 2026-10-25
Updaterun 2026-10-26T0256Z-intelactionsaffected_productsbodycvesentitiesevidencesourcessummary

Two more vendors have shipped fixes for the same decoder flaw. Envoy's advisory of 2026-10-23 says a buffer overflow in its Brotli decompressor allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service or potentially execute arbitrary code with a crafted Brotli-compressed stream; it names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable, v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12 as fixed, and limits the impact to deployments that have the Brotli decompressor configured (Envoy, 2026-10-23). Microsoft's out-of-band .NET release of 2026-10-25 (8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3) fixes the same CVE, and an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the Brotli APIs (dotnet/announcements #494, 2026-10-25); .NET Blog, 2026-10-25 lists the fixed releases. No source reports exploitation outside Imperva's laboratory demonstration against Node.js.

Updaterun 2026-10-27T0256Z-intelactionsaffected_productsbodycvesentitiesevidenceheadlinesourcessummarytags

NCSC Switzerland (BACS) published advisory 13105 on 2026-10-26 on the Brotli decoder flaw: it names Node.js, Microsoft .NET, Visual Studio, PowerShell, the Python Brotli and brotlicffi packages and Bun among the affected dependents, rates the current exploitation status unknown with a proof of concept available, and gives as the temporary measure disabling Brotli decoding of untrusted data and rejecting Content-Encoding: br until patched, with services restarted and containers rebuilt after updating (NCSC Switzerland, 2026-10-26).

Palo Alto Networks lists PAN-OS 12.2 before 12.2.4-h1, 12.1 before 12.1.4-h13, 12.1.7-h11 and 12.1.10-h3, and 11.2 before 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4 and 11.2.16-h1 as affected, but only on PA-Series and VM-Series firewalls that have inspection of Brotli-compressed traffic and TLS decryption enabled on the dataplane; PAN-OS 11.1 and 10.2 and the management interface are not affected, and the hotfixes carry estimated dates from 2026-10-27 to 2026-10-30 (Palo Alto Networks, 2026-10-26). Brotli encoding is disabled by default in PAN-OS 11.2.4 and later, the command show system setting brotli shows whether a firewall is exposed (Enabled: yes), and set system setting brotli-encoding disable is the vendor's interim mitigation; Palo Alto rates the urgency moderate and is not aware of malicious exploitation (Palo Alto Networks, 2026-10-26).

PHP rebuilt its Windows packages as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on 2026-10-26 with Brotli 1.2.1; the vulnerable decoder is reachable there through the cURL extension when automatic HTTP response decompression is enabled, which cURL leaves off by default (PHP, 2026-10-26). Ubuntu lists brotli fixes for 26.10 (1.2.0-4ubuntu0.1), 26.04 LTS (1.2.0-3ubuntu0.1), 24.04 LTS (1.1.0-2ubuntu0.1) and 22.04 LTS (1.0.9-2ubuntu0.1), marks 20.04 LTS as needing evaluation and its nodejs package on 20.04, which vendors Brotli, as vulnerable (Ubuntu, 2026-10-26).

Updaterun 2026-10-28T0256Z-intelheadlinesummaryprioritytagscvessourcesevidencesourcing_noteactionsbodyaffected_productsentities

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", naming no actor or victim (CISA, 2026-10-27). ELLIO's sensors recorded a public checker that maps hosts decompressing Brotli and then, on 2026-10-26, one Brotli-coded request body of about 23 MB built against Node.js 24.22.0 on x86-64, which ELLIO reads as adoption by an operator focused on mass exploitation; its own test of the attacker's chain against that build got no shell in 50 attempts, so a failed attempt shows as a worker crash (ELLIO, 2026-10-26). Tenable relays the report and has not confirmed it (Tenable, 2026-10-26); Cisco and Palo Alto report no malicious use against their own products (Cisco PSIRT, 2026-10-27; Palo Alto Networks, 2026-10-28). Palo Alto's advisory, as read on 2026-10-28, shows six of the nine PAN-OS hotfixes released and the other three, 12.1.4-h13, 12.1.10-h3 and 11.2.4-h23, due on 2026-10-29 and 2026-10-30 (Palo Alto Networks, 2026-10-28).

JFrog reproduced a remote crash of a ClickHouse server with one request carrying a crafted 23 MB body, with the fix merged but not released when it wrote (JFrog, 2026-10-25). Akamai gives a lever for Express 5 and body-parser 2 services that accept no compressed request bodies: set the inflate option to false (Akamai, 2026-10-26). A Node.js build is judged by its release version, because the bundled version string reads 1.2.0 on patched builds as well (ELLIO, 2026-10-26).

vulnerability24 Oct 03:33Zmulti-sourceOpen finding →
Sources: Node.js project · Node.js project (release v22.23.4) · Node.js project (release v24.22.1) · Node.js project (release v26.12.1) · Google Brotli · ENISA EUVD · Imperva Threat Research · OpenSourceMalware · Envoy Proxy (security advisory) · .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory) · NCSC Switzerland (BACS, Cyber Security Hub advisory 13105) · Palo Alto Networks PSIRT (CVE-2026-111497 portfolio status) · PHP (news archive, updated Windows builds for the Brotli fix) · Ubuntu Security (CVE-2026-111497) · CISA (alert, KEV additions) · ELLIO Threat Research Lab · Tenable Research · JFrog Security Research · Akamai Security Intelligence Group · Cisco PSIRT (advisory, Vulnerabilities in node.js Affecting Cisco Products) · Palo Alto Networks PSIRT (CVE-2026-111497 portfolio status, as read on 2026-10-28)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • nodejs.org4 (19%)
  • github.com3 (14%)
  • akamai.com1 (5%)
  • cisa.gov1 (5%)
  • devblogs.microsoft.com1 (5%)
  • ellio.tech1 (5%)
  • euvdservices.enisa.europa.eu1 (5%)
  • imperva.com1 (5%)
  • other8 (38%)
All cited sources (21)