[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQFapeswcuBmWfdLHT6hyz19PDf4YHTWed_1bUyjy2xM":3},{"article":4,"iocs":51,"watch_terms":67,"solutions":68,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f4f92c1e-1751-4225-ab14-34737502ae4c","Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own","can-t-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own-50be5d","Executive Summary Node.js has fixed CVE-2026-111497, a Brotli decoder flaw that can permit remote code execution, in 22.23.4, 24.22.1, and 26.12.1, but upgrading at scale is slow. In Qualys telemetry, only 42,000 of roughly 3 million Node.js installations have been patched, and 1.7 million run end-of-life lines that will never receive a fix. In the […]","Node.js has released security fixes for CVE-2026-111497, a Brotli decoder flaw enabling remote code execution, along with nine other vulnerabilities in versions 22.23.4, 24.22.1, and 26.12.1. Qualys telemetry reveals slow patch adoption with only 42,000 of 3.3 million Node.js installations updated, while 1.7 million run end-of-life versions that will never receive fixes. The article provides interim mitigation strategies—including Brotli exposure limits, safer DNS calls, and compensating controls via WAF, IPS, and EDR—to reduce risk while organizations complete runtime upgrades.","Node.js patches CVE-2026-111497 Brotli RCE flaw; only 42k of 3.3M installations updated so far.","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F10\u002F27\u002Fcant-patch-node-js-yet-build-a-stopgap-with-the-controls-you-own","https:\u002F\u002Fblog.qualys.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-10.png","2026-10-28T06:35:45+00:00","2026-10-28T07:00:08.063821+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Node.js","product",{"name":21,"type":22},"Qualys","vendor",{"name":24,"type":25},"Brotli","technology",{"name":27,"type":25},"DNS",{"name":29,"type":25},"TLS","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[52,56,59,61,64],{"type":53,"value":54,"context":55},"cve","CVE-2026-111497","Brotli decoder flaw in Node.js permitting remote code execution",{"type":53,"value":57,"context":58},"CVE-2026-106069","TLS hostname validation weakness in Node.js",{"type":53,"value":60,"context":58},"CVE-2026-105483",{"type":53,"value":62,"context":63},"CVE-2026-105482","DNS validation flaw in Node.js",{"type":53,"value":65,"context":66},"CVE-2026-106072","IP address canonicalization issue in Node.js",[21,18],{"controls":69,"vendors":155},[70,99,126],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,110,118],{"vendor_slug":105,"vendor_name":21,"vendor_logo":106,"product_slug":100,"product_name":107,"url":108,"description":109},"qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":127,"name":128,"problem":129,"products":130},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[156],{"slug":105,"name":21,"logo_path":106,"roles":157},[158],"reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"millions-of-unpatched-nodejs-installs-expose-organizations-to-remote-code-execution","Millions of Unpatched Node.js Installs Expose Organizations to Remote Code Execution","A critical Brotli decoder flaw (CVE-2026-111497) in Node.js enables remote code execution, yet Qualys telemetry shows that only 42,000 of 3.3 million installations have been updated — a patch adoption rate of barely 1.3%. More alarming, 1.7 million instances run end-of-life versions that will never receive a fix, leaving a massive permanent attack surface. This incident illustrates that vulnerability management is not just about knowing a patch exists, but operationalizing its deployment at scale and within a defined remediation window. Organizations without mature patch pipelines or software inventory controls are effectively flying blind, unable to distinguish patched assets from exposed ones.",[164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":172,"PCI DSS Requirement 6":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"OWASP A06:2021 Vulnerable and Outdated Components":175,"CIS Control 7: Continuous Vulnerability Management":176,"CIS Control 2: Inventory and Control of Software Assets":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178},"NIS2 requires essential and important entities to implement policies on vulnerability handling and patching; the scale of unpatched Node.js deployments would constitute a direct failure of this obligation for in-scope organizations.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching; any Node.js deployment handling cardholder data and left unpatched would be a clear PCI DSS violation.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods; the near-zero patch adoption rate demonstrates this control is not implemented or enforced.","Running 1.7 million end-of-life Node.js installations is a textbook example of A06, where organizations fail to track, upgrade, or replace components that are no longer receiving security fixes.","With only 1.3% of installations patched, organizations clearly lack a continuous vulnerability management process that would enforce scanning, prioritization, and time-bound remediation for critical RCE flaws like this one.","The inability to identify 3.3 million Node.js instances — including 1.7 million end-of-life versions — stems directly from the absence of an authoritative software asset inventory that would surface unsupported runtimes.","This control mandates timely identification and remediation of technical vulnerabilities; the article's evidence of slow patch adoption and untracked EOL deployments shows this control is absent or ineffective."]