FortiGuard Outbreak Alert: Node2Shell Remote Code Execution
Description | Node.js is a JavaScript runtime used to build server-side applications and network services. It includes Google's Brotli decoder to decompress Brotli-compressed data. CVE-2026-111497, commonly known as Node2Shell, is an out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js. When a vulnerable application decompresses attacker-controlled Brotli data, specially crafted input can corrupt process memory, potentially causing information disclosure, denial of service, or remote code execution. The following Node.js releases are affected by CVE-2026-111497:
For technical details and remediation guidance, refer to the Node.js October 2026 security advisory. | ||||||||||||
CVE ID | |||||||||||||
FortiNDR Cloud Coverage | FortiNDR Cloud v26.3+
| ||||||||||||
Playbook | N/A | ||||||||||||
Threat Hunting | FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for “Node2Shell Remote Code Execution” related activities. IOC source: Node2Shell Remote Code Execution | Indicators of Compromise All IOCs relating to “Node2Shell Remote Code Execution” have been added to Threat Intelligence Intel. | ||||||||||||
Suricata/DPI Coverage | Customers can create custom investigations/detections using the DPI and Suricata signatures below: DPI:
Suricata (FortiNDR Cloud custom signatures):
| ||||||||||||
Other Fortinet Products | For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to Node2Shell Remote Code Execution. |
