Node.js: Mehrere Schwachstellen
WID-SEC-2026-4117 · first 22.10.2026 · updated 29.10.2026 · CVSS 9,8
What it is about
Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen. Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service Angriff durchzuführen
- Sicherheitsvorkehrungen zu umgehen
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Red Hat Enterprise Linux
- Fedora Linux
- Microsoft .NET
- Ubuntu Linux
- Oracle Linux
- Open Source Node.js <26.12.1
- Open Source Node.js <24.22.1
- Open Source Node.js <22.23.4
- Oracle Java SE 25.0.5.0.2
- Oracle Java SE 17.0.21.0.2
- Oracle Java SE 8u511-perf-b32
and 19 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Node.js 26.12.1
- Open Source Node.js 24.22.1
- Open Source Node.js 22.23.4
- Palo Alto Networks PAN-OS 12.2.4-h1
- Palo Alto Networks PAN-OS 12.1.4-h13
- Palo Alto Networks PAN-OS 12.1.7-h11
- Palo Alto Networks PAN-OS 12.1.10-h3
- Palo Alto Networks PAN-OS 11.2.4-h23
- Palo Alto Networks PAN-OS 11.2.7-h23
- Palo Alto Networks PAN-OS 11.2.10-h17
- Palo Alto Networks PAN-OS 11.2.13-h4
- Palo Alto Networks PAN-OS 11.2.16-h1
Is the vulnerability already being exploited?
- CVE-2026-111497: exploited in the wild according to CISA, in the catalogue since 27.10.2026.
Information and sources
- Original BSI advisory (WID)
- Node.js Security Release vom 2026-10-21 nodejs.org
- Node.js Security Release vom 2026-10-21 nodejs.org
- Node.js Security Release vom 2026-10-21 nodejs.org
- Node.js Security Release vom 2026-10-21 nodejs.org
- PoC CVE-2026-111497 Node2Shell www.imperva.com
- Red Hat Security Advisory RHSA-2026:87420 vom 2026-10-23 access.redhat.com
- Fedora Security Advisory FEDORA-2026-A336A99528 vom 2026-10-26 bodhi.fedoraproject.org
- Debian Security Advisory DLA-4855 vom 2026-10-24 lists.debian.org
- Debian Security Advisory DSA-6582 vom 2026-10-24 security-tracker.debian.org
- Fedora Security Advisory FEDORA-2026-5B98DD6D78 vom 2026-10-26 bodhi.fedoraproject.org
- Microsoft Security Update Guide msrc.microsoft.com
- Oracle Linux Security Advisory ELSA-2026-500514 vom 2026-10-27 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:90501 vom 2026-10-26 access.redhat.com
- Fedora Security Advisory FEDORA-2026-4AADE61415 vom 2026-10-26 bodhi.fedoraproject.org
- Oracle Linux Security Advisory ELSA-2026-500517 vom 2026-10-27 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:90495 vom 2026-10-26 access.redhat.com
- Oracle Linux Security Advisory ELSA-2026-500515 vom 2026-10-27 linux.oracle.com
- Fedora Security Advisory FEDORA-2026-92436BEF9C vom 2026-10-26 bodhi.fedoraproject.org
- Oracle Linux Security Advisory ELSA-2026-500516 vom 2026-10-27 linux.oracle.com
- Ubuntu Security Notice USN-8956-1 vom 2026-10-26 ubuntu.com
- Oracle Linux Security Advisory ELSA-2026-500513 vom 2026-10-27 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-500512 vom 2026-10-27 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-500520 vom 2026-10-27 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-500518 vom 2026-10-26 linux.oracle.com
- Red Hat Security Advisory RHSA-2026:90449 vom 2026-10-26 access.redhat.com
and 16 more sources in the original advisory
CVE: CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106070, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497, CVE-2026-28330
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.