[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":67,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":74,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":80,"vulnerability-29896":87},[4,29,36,44,53,59],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - top pages, pricing CTA","php2shell-rce","🚨 Detect PHP2Shell with any paid plan. Get proof now","https:\u002F\u002Fpentest-tools.com\u002Fpricing",true,[11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"\u002F","\u002Fport-scanner-online-nmap","\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffind-subdomains-of-domain","\u002Fdiscover-hidden-directories-and-files","\u002Fvulnerabilities-exploits\u002Fphp2shell-remote-code-execution-cve-2026-109618-and-cve-2026-109619_29870","\u002Ffor\u002Ffree","\u002Ffeatures\u002Fattack-surface","\u002Ffeatures\u002Fauthenticated-web-app-scanning","\u002Ffeatures\u002Finternal-network-scanning","\u002Ffeatures\u002Fvulnerability-monitoring","\u002Ffeatures\u002Fvulnerability-assessment-reporting","\u002Ffeatures\u002Fpentest-reporting","\u002Fsolutions\u002Ffor-it-teams","\u002Fsolutions\u002Ffor-msps","\u002Fsolutions\u002Ffor-security-teams","See pricing options","secondary",{"title":30,"slug":31,"text":32,"link":8,"external":9,"targets":33,"cta":35,"variant":28,"campaign_id":6},"PHP2Shell detection - NetScan on the NS page","php2shell-rce-netscan","🚨 Detect PHP2Shell with NetScan (from $96\u002Fmo for 16 assets)",[34],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick NetScan",{"title":37,"slug":38,"text":39,"link":40,"external":41,"targets":42,"cta":40,"variant":28,"campaign_id":6},"PHP2Shell & Node2Shell detection - pricing page","php2shell-rce-pricing","PHP2Shell & Node2Shell detection live in every paid plan (unlimited rescans for patch validation)",null,false,[43],"\u002Fpricing",{"title":45,"slug":46,"text":47,"link":48,"external":9,"targets":49,"cta":52,"variant":28,"campaign_id":46},"Office Hours #14","office-hours-14","[Live Office Hours, Wed Oct 28] Check, patch, prove: PHP2Shell and other critical CVEs","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_xbwerEx9QFSjfNWIHcjtHw",[50,51],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":54,"slug":55,"text":56,"link":8,"external":9,"targets":57,"cta":27,"variant":28,"campaign_id":6},"PHP2Shell detection - WP Scanner","php2shell-rce-pricing-1","Detect PHP2Shell with the WP Scanner! Available with every paid plan",[58],"\u002Fcms-vulnerability-scanning\u002Fwordpress-scanner-online-wpscan",{"title":60,"slug":61,"text":62,"link":8,"external":9,"targets":63,"cta":27,"variant":28,"campaign_id":61},"Node2Shell detection - Vuln DB homepage, product, CVE page","node2shell","🚨 Detect Node2Shell with any paid plan. Get proof now",[64,65,66],"\u002Fvulnerabilities-exploits","\u002Fproduct","\u002Fvulnerabilities-exploits\u002Fnode2shell-brotli-decoder-remote-code-execution_29896",["Island",68],{"key":69,"params":70,"result":72},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":71},"{}",{"head":73},{},["Island",75],{"key":76,"params":77,"result":78},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":71},{"head":79},{},["Island",81],{"key":82,"params":83,"result":85},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":84},"{\"text-color\":\"gray\"}",{"head":86},{},{"id":88,"detectable_with":89,"vuln_details":96,"vuln_id":120,"name":121,"published":122,"updated":40},29896,{"tool":90,"engine":93},{"id":91,"name":92},1,"Network Scanner",{"id":94,"name":95},2,"Nuclei",{"id":88,"codename":61,"description":40,"severity":97,"risk_description":98,"public_description":99,"public_recommendation":100,"recommendation":40,"references":101,"cvssv3":112,"epss_score":113,"epss_percentile":114,"cve":115,"in_cisa_catalog":41,"date":117,"software_type":40,"vendor":118,"product":119,"ptt_exploit_capabilities":40},"critical","An unauthenticated attacker who can send Brotli-compressed request bodies to the application or proxy, or make it fetch Brotli-compressed responses from a server they control, can corrupt process memory and potentially run code with the privileges of the Node.js, Bun or Envoy process. A probe match means the endpoint decoded a Brotli request body with a vulnerable decoder; it does not execute code. A Node.js or Bun version match is based on the version the application discloses and does not confirm that a Brotli decoding path is reachable. Endpoints that decode Brotli request bodies receive an upload of about 23 MB. A reachable Envoy admin API is a separate exposure in its own right, because it leaks the full proxy configuration and allows runtime changes.","The Google Brotli decoder bundled in Node.js versions prior to 22.23.4, 24.22.1 and 26.12.1, in Bun versions prior to 1.4.4, and in Envoy Proxy versions prior to 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0, contains an out-of-bounds write. Crafted Brotli-compressed data can corrupt memory, leading to crashes, memory disclosure or remote code execution. Node.js applications are reachable through Brotli request-body parsing (for example Express 5 with body-parser 2) and through server-side HTTP clients such as fetch() that decode Brotli responses. Envoy, and Istio through its sidecars, is only exposed when an HTTP decompressor filter uses the Brotli library. The main check is a differential probe. It learns the endpoint's normal and malformed-Brotli response classes with four one-byte POST requests, which every target receives. Only endpoints that decode Brotli request bodies then receive a 23 MB Brotli stream, which a patched decoder rejects as malformed and a vulnerable decoder accepts, followed by a final one-byte request. If the probe is inconclusive, the template falls back to version checks. It reads the Envoy version from the exposed admin API (\u002Fserver_info) and confirms through \u002Fconfig_dump that a Brotli decompressor is configured, or reads a Node.js or Bun version disclosed in response headers or in a health, status or version endpoint.","Upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later and rebuild container images that bundle the runtime. Upgrade Bun to 1.4.4 or later. Upgrade Envoy Proxy to 1.40.0, 1.39.3, 1.38.6, 1.37.8 or later in the same supported branch (1.36.12 also contains the fix, but 1.36 is unsupported), and Istio to 1.29.9, 1.30.6, 1.31.2 or later. Until you can patch, reject Content-Encoding br request bodies before any parser decodes them, disable Brotli decoding in server-side HTTP clients, and disable the Envoy Brotli decompressor filter for both directions. Bind the Envoy admin interface to localhost or a management network, and stop disclosing the Node.js or Bun version in response headers and public health or status endpoints.",[102,103,104,105,106,107,108,109,110,111],"https:\u002F\u002Fpatchtheplanet.org\u002Fbrotli","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases","https:\u002F\u002Fbun.com\u002Fblog\u002Fbun-v1.4.4","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111497","https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-111497","https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Freleases","https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Freleases\u002Ftag\u002Fv1.36.12","https:\u002F\u002Fistio.io\u002Flatest\u002Fnews\u002Fsecurity\u002Fistio-security-2026-007\u002F","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fbrotli\u002Freleases\u002Ftag\u002Fv1.2.1","https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fnode2shell-from-brotli-data-to-remote-code-execution\u002F",9.2,0.0071,0.53063,[116],"CVE-2026-111497","2026-10-24T00:00:00Z","nodejs","node.js","NETSCAN-NUCLEI-CVE-CVE-2026-111497","Node2Shell - Brotli Decoder Remote Code Execution","2026-10-25T00:00:00Z"]