https://tube.the-morpheus.de/videos/watch/8de593a6-a7dc-422f-a665-227a2baa39fb CVE-2026-111497, in der Szene Node2Shell, ist eine Lücke im Brotli-Decoder, den Node.js gleich mitbringt, und der Fix dafür stand knapp acht Monate im öffentlichen Brotli-Repo. Quellen zum Video: https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ https://github.com/google/brotli https://opensource.googleblog.com/2015/09/introducing-brotli-new-compression.html https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Accept-Encoding https://github.com/nodejs/node/tree/v24.22.0/deps https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p https://github.com/google/brotli/blob/v1.0.3/c/dec/decode.c#L1110-L1111 https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/ https://github.com/google/brotli/releases/tag/v1.2.1 https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b https://nodejs.org/en/blog/vulnerability/october-2026-security-releases https://previdian.com/CVE-2026-111497 https://www.cve.org/CVERecord?id=CVE-2026-111497 https://nvd.nist.gov/vuln/detail/CVE-2026-111497 https://github.com/advisories/GHSA-9v8h-qqgm-4m35 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 https://expressjs.com/en/guide/migrating-5/ https://github.com/nodejs/undici/blob/v7.30.1/lib/web/fetch/index.js#L2256-L2257 https://api.npmjs.org/versions/express/last-week https://www.rfc-editor.org/rfc/rfc7932.txt https://github.com/google/brotli/blob/v1.2.0/c/dec/decode.c#L1189-L1190 https://github.com/google/brotli/releases/tag/v1.2.0 https://x.com/OpenAI/status/2113766354386084338 https://github.com/nodejs/node/blob/v24.22.0/deps/brotli/c/common/version.h#L20-L22 https://github.com/nodejs/node/blob/v24.22.1/deps/brotli/c/common/version.h#L20-L22 https://github.com/nodejs/node/commit/67d294739f7b8eb3329c04cd8a3d0978c49de422 https://github.com/nodejs/node/commit/49dff6f57aa72cbbe13e480cd41ff4e46837c8fc https://github.com/nodejs/node/commit/a6040b50d958e489c501e9c16c60c0ce2c55ec70 https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr https://github.com/dotnet/announcements/issues/494 https://raw.githubusercontent.com/nodejs/Release/main/schedule.json MorphReader im PlayStore: https://play.google.com/store/apps/details?id=de.themorpheus.morph_reader_app&hl=de MorphReader im App Store: https://apps.apple.com/de/app/morphreader/id6741467699?platform=iphone Newsletter und RSS-Feeds: https://www.patreon.com/collection/880029?view=expanded Kostenlos Informatik lernen mit der Bootstrap Academy: https://bootstrap.academy/ https://github.com/Bootstrap-Academy/ Instagram: https://www.instagram.com/themorpheustuts/ Meine anderen Kanäle und Projekte: https://the-morpheus.de/ Discord: https://the-morpheus.de/discord.html Unterstützt mich – danke! https://www.patreon.com/user?u=5322110 https://www.paypal.me/TheMorpheus Kapitel: 00:00 Intro: Node2Shell nach PHP2Shell 00:50 Was Brotli ist 01:18 Die Lücke: CVE-2026-111497 02:02 Wer betroffen ist: Express und fetch 02:45 Das Format: Counter und Block-Switch 03:21 Return Value und Caller 04:13 Der Buffer 05:21 Der Fix im Commit 06:05 Vom Commit zum Update 06:31 Ausnutzung in der Praxis 07:00 Prüfen und patchen Sat, 31 Oct 2026 17:13:13 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://tube.the-morpheus.de https://tube.the-morpheus.de/client/assets/images/icons/icon-1500x1500.png https://tube.the-morpheus.de/videos/watch/8de593a6-a7dc-422f-a665-227a2baa39fb All rights reserved, unless otherwise specified in the terms specified at https://tube.the-morpheus.de/about and potential licenses granted by each content's rightholder. https://tube.the-morpheus.de/w/iwh5kABrQiUMX7ip1rYGPD;threadId=5070 https://tube.the-morpheus.de/w/iwh5kABrQiUMX7ip1rYGPD;threadId=5070 Sat, 31 Oct 2026 11:44:10 GMT @morpheus danke, hab meine spliit instance erstmal offline genommen, bis ich zeit hab n geupdatedes image zu bauen

]]> 6543 https://tube.the-morpheus.de/w/iwh5kABrQiUMX7ip1rYGPD;threadId=5069 https://tube.the-morpheus.de/w/iwh5kABrQiUMX7ip1rYGPD;threadId=5069 Sat, 31 Oct 2026 09:51:03 GMT @morpheus well that sucks

]]> Bastian