{"id":12239,"date":"2026-10-23T18:03:13","date_gmt":"2026-10-24T00:03:13","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-124-critical-node-js-vulnerability-node2shell\/"},"modified":"2026-10-23T18:05:01","modified_gmt":"2026-10-24T00:05:01","slug":"alert-2026-124-critical-node-js-vulnerability-node2shell","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/","title":{"rendered":"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Affected product(s):<\/h2>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Affected versions<\/strong><\/td><\/tr><tr><td><strong>Node.js<\/strong><\/td><td>22.x earlier than 22.23.4, <br \/>24.x earlier than 24.22.1, and <br \/>26.x earlier than 26.12.1<\/td><\/tr><tr><td><strong>Google Brotli<\/strong><\/td><td>From 1.0.3 through 1.2.0<\/td><\/tr><tr><td><strong>Bun<\/strong><\/td><td>Earlier than 1.4.4<\/td><\/tr><tr><td><strong>Brotli (PyPI package)<\/strong><\/td><td>1.2.0 and earlier<\/td><\/tr><tr><td><strong>brotlicffi (PyPI package)<\/strong><\/td><td>1.2.0.2 and earlier<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">Unsupported Node.js branches (EoL) are also considered affected.<\/p>\n\n<h2 class=\"wp-block-heading\">Description<\/h2>\n\n<p class=\"wp-block-paragraph\">An out-of-bounds write vulnerability has been disclosed in Node.js, known as Node2Shell and identified as CVE-2026-111497 (CVSSv4 9.2 &#8211; CRITICAL). An unauthenticated remote attacker can send specially crafted Brotli-compressed data and corrupt process memory, potentially causing a denial of service, memory disclosure, or remote code execution. The flaw can be reached through <code>fetch()<\/code>, request bodies processed by Express 5 with body-parser 2.x, and <code>node:zlib<\/code>. It is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1.<\/p>\n\n<p class=\"wp-block-paragraph\">The source of the vulnerability lies in the Google Brotli decoder (<code>c\/dec\/decode.c<\/code>), which Node.js includes in its source code. When a compressed stream requests an invalid block switch, the <code>DecodeBlockTypeAndLength()<\/code> function returns a value that the fast decoding path does not check (CWE-252, unchecked return value). The decoder continues processing with a corrupted internal state and writes outside the bounds of its buffer (CWE-787, out-of-bounds write). Brotli versions from 1.0.3 through 1.2.0 are affected and are fixed in 1.0.10, 1.1.1, and 1.2.1, released on 21\/10\/2026.<\/p>\n\n<p class=\"wp-block-paragraph\">Because the vulnerable code is in the Brotli library, it also affects Bun, fixed in version 1.4.4, and the Python <code>Brotli<\/code> and <code>brotlicffi<\/code> packages from PyPI, fixed in 1.2.1 and 1.2.1.0. The Python packages were updated without mentioning the vulnerability in their release notes, so dependency scanners may not flag them as vulnerable. The vulnerability was disclosed by Imperva. As of the date of this advisory, no active exploitation has been reported.<\/p>\n\n<h2 class=\"wp-block-heading\">Mitigation<\/h2>\n\n<p class=\"wp-block-paragraph\">If an immediate update is not possible, OpenSourceMalware indicates two temporary alternatives until the update is applied in Python environments:<\/p>\n\n<ul class=\"wp-block-list\">\n<li>Uninstall the <code>Brotli<\/code> and <code>brotlicffi<\/code> packages. Without them, HTTP clients such as <code>urllib3<\/code> (and therefore <code>requests<\/code>), <code>httpx<\/code>, <code>aiohttp<\/code>, and Scrapy switch to using gzip\/deflate.<\/li>\n\n\n\n<li>Remove <code>br<\/code> from the <code>Accept-Encoding<\/code> header in outgoing requests and reject <code>Content-Encoding: br<\/code> in incoming requests.<\/li>\n<\/ul>\n\n<h2 class=\"wp-block-heading\">Solution<\/h2>\n\n<p class=\"wp-block-paragraph\">The solution is to update Node.js, Bun, and the Python packages to the fixed versions, and to update Brotli in any software that includes the library.<\/p>\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Product<\/strong><\/td><td><strong>Fixed version<\/strong><\/td><\/tr><tr><td><strong>Node.js 22.x<\/strong><\/td><td>22.23.4<\/td><\/tr><tr><td><strong>Node.js 24.x<\/strong><\/td><td>24.22.1<\/td><\/tr><tr><td><strong>Node.js 26.x<\/strong><\/td><td>26.12.1<\/td><\/tr><tr><td><strong>Google Brotli<\/strong><\/td><td>1.0.10, 1.1.1, or 1.2.1<\/td><\/tr><tr><td><strong>Bun<\/strong><\/td><td>1.4.4 or later<\/td><\/tr><tr><td><strong>Brotli (PyPI package)<\/strong><\/td><td>1.2.1<\/td><\/tr><tr><td><strong>brotlicffi (PyPI package)<\/strong><\/td><td>1.2.1.0<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\">In Python environments:<\/p>\n\n<pre class=\"wp-block-code\"><code>pip install -U \"Brotli&gt;=1.2.1\" \"brotlicffi&gt;=1.2.1.0\"<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">It is recommended to manually review transitive dependencies, as scanners may not flag these packages, and to rebuild containers and images that include vulnerable versions. Services that decompress Brotli content from untrusted sources should be prioritized.<\/p>\n\n<p class=\"wp-block-paragraph\">Node.js versions:<\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\">https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases<\/a><\/p>\n\n<p class=\"wp-block-paragraph\">Google Brotli versions:<\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/google\/brotli\/releases\">https:\/\/github.com\/google\/brotli\/releases<\/a><\/p>\n\n<p class=\"wp-block-paragraph\">Bun 1.4.4:<\/p>\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/bun.com\/blog\/bun-v1.4.4\">https:\/\/bun.com\/blog\/bun-v1.4.4<\/a><\/p>\n\n<h2 class=\"wp-block-heading\">Additional information:<\/h2>\n\n<ul class=\"wp-block-list\">\n<li>Node.js \u2014 October 2026 Security Releases:<br \/><a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"noopener\">https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases<\/a><\/li>\n\n\n\n<li>CVE.org \u2014 CVE-2026-111497:<br \/><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-111497\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2026-111497<\/a><\/li>\n\n\n\n<li>OSV \u2014 CVE-2026-111497:<br \/><a href=\"https:\/\/osv.dev\/vulnerability\/CVE-2026-111497\" target=\"_blank\" rel=\"noopener\">https:\/\/osv.dev\/vulnerability\/CVE-2026-111497<\/a><\/li>\n\n\n\n<li>Google Brotli \u2014 releases 1.0.10, 1.1.1, and 1.2.1:<br \/><a href=\"https:\/\/github.com\/google\/brotli\/releases\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/google\/brotli\/releases<\/a><\/li>\n\n\n\n<li>Bun \u2014 GHSA-663w-cv8g-jj2p advisory:<br \/><a href=\"https:\/\/github.com\/oven-sh\/bun\/security\/advisories\/GHSA-663w-cv8g-jj2p\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/oven-sh\/bun\/security\/advisories\/GHSA-663w-cv8g-jj2p<\/a><\/li>\n\n\n\n<li>OpenSourceMalware \u2014 Node2Shell in Python packages:<br \/><a href=\"https:\/\/opensourcemalware.com\/blog\/node2shell-affects-python\" target=\"_blank\" rel=\"noopener\">https:\/\/opensourcemalware.com\/blog\/node2shell-affects-python<\/a><\/li>\n\n\n\n<li>Aikido Security \u2014 advisory on Node2Shell in Python:<br \/><a href=\"https:\/\/x.com\/AikidoSecurity\/status\/2113733621064593679\" target=\"_blank\" rel=\"noopener\">https:\/\/x.com\/AikidoSecurity\/status\/2113733621064593679<\/a><\/li>\n<\/ul>\n","protected":false},"featured_media":12234,"template":"","class_list":["post-12239","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Flaw in Node.js&#039;s Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)\" \/>\n\t\t<meta property=\"og:description\" content=\"Flaw in Node.js&#039;s Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-24T00:03:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-24T00:05:01+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Flaw in Node.js&#039;s Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#listItem\",\"name\":\"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#listItem\",\"position\":2,\"name\":\"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/\",\"name\":\"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)\",\"description\":\"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/nodejs-logo-destacada.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#mainImage\",\"width\":600,\"height\":600},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/alert-2026-124-critical-node-js-vulnerability-node2shell\\\/#mainImage\"},\"datePublished\":\"2026-10-23T18:03:13-06:00\",\"dateModified\":\"2026-10-23T18:05:01-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)","description":"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#listItem","name":"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#listItem","position":2,"name":"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/","name":"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)","description":"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/nodejs-logo-destacada.png","@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#mainImage","width":600,"height":600},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/#mainImage"},"datePublished":"2026-10-23T18:03:13-06:00","dateModified":"2026-10-23T18:05:01-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)","og:description":"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.","og:url":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png","article:published_time":"2026-10-24T00:03:13+00:00","article:modified_time":"2026-10-24T00:05:01+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)","twitter:description":"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png"},"aioseo_meta_data":{"post_id":"12239","title":"Node2Shell: critical vulnerability in Node.js (CVE-2026-111497)","description":"Flaw in Node.js's Brotli decoder (CVE-2026-111497) corrupts memory via fetch() and Express 5. Update to 22.23.4, 24.22.1, or 26.12.1.","keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"custom_image","og_image_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png","og_image_width":"0","og_image_height":"0","og_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png","og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"custom_image","twitter_image_url":null,"twitter_image_custom_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/10\/og-nodejs-2026-124-1200x630-1.png","twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2026-10-24 00:05:01","updated":"2026-10-24 00:13:38","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2026-124 Critical Node.js Vulnerability (Node2Shell)\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-124-critical-node-js-vulnerability-node2shell\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12239","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12239\/revisions"}],"predecessor-version":[{"id":12240,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/12239\/revisions\/12240"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/12234"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=12239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}