[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":64,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":70,"vulnerability-29936":77},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},["Island",65],{"key":66,"params":67,"result":68},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":69},{},["Island",71],{"key":72,"params":73,"result":75},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":74},"{\"text-color\":\"gray\"}",{"head":76},{},{"id":78,"detectable_with":79,"vuln_details":85,"vuln_id":107,"name":108,"published":109,"updated":109},29936,{"tool":80,"engine":83},{"id":81,"name":82},1,"Network Scanner",{"id":81,"name":84},"Sniper",{"id":78,"codename":86,"description":87,"severity":88,"risk_description":89,"public_description":90,"public_recommendation":91,"recommendation":92,"references":93,"cvssv3":97,"epss_score":98,"epss_percentile":99,"cve":100,"in_cisa_catalog":18,"date":102,"software_type":103,"vendor":104,"product":104,"ptt_exploit_capabilities":105},"node2shell","We found that the target server is vulnerable to CVE-2026-111497, an out-of-bounds write in the Brotli streaming decompression decoder bundled with Node.js. An invalid block-switch command is mis-reported as a temporary need for more input instead of a permanent format error (CWE-252), so the streaming decoder keeps appending input past the end of a fixed 8-byte internal buffer (CWE-787), corrupting adjacent decoder state. The decode path is reached remotely whenever the application decompresses attacker-supplied Brotli data, for example an Express body-parser request body sent with Content-Encoding: br. We confirmed the vulnerability with a non-destructive differential probe: a valid and a short malformed Brotli stream produce distinct responses (so the endpoint decodes Brotli), while a 23 MB malformed stream is processed differently from the short malformed one, a behaviour a patched decoder does not exhibit. On an affected build the out-of-bounds write can be escalated to remote code execution.","critical","The risk exists that a remote unauthenticated attacker can fully compromise the server in order to steal confidential information, install ransomware or pivot to the internal network.","Node.js is affected by an out-of-bounds write in its bundled Brotli decompression decoder. When the runtime decompresses attacker-supplied Brotli data, an invalid stream causes the decoder to write past a fixed internal buffer and corrupt adjacent memory. Depending on the context this can crash the process, disclose process memory, or be leveraged for remote code execution, and it is reachable without authentication whenever the server decompresses externally supplied Brotli input (such as a br-encoded request body or a fetched response).","Update Node.js to 24.22.1, 22.23.4 or 26.12.1 or later.","We recommend to update Node.js to a fixed release (24.22.1, 22.23.4 or 26.12.1 or later), or to update the bundled Brotli library to 1.0.10, 1.1.1 or 1.2.1. If an immediate upgrade is not possible, disable or restrict application code paths that decompress attacker-controlled Brotli data.",[94,95,96],"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9v8h-qqgm-4m35","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111497",9.2,0.82641,0.9967,[101],"CVE-2026-111497","2026-10-24T00:00:00Z","JavaScript Runtime","Node.js",[106],"RCE","NETSCAN-SNIPER-CVE-2026-111497","Node.js - Remote Code Execution","2026-10-26T00:00:00Z"]