Act today Critical Known exploited Check your exposure
Siemens lists products affected by Node.js Brotli flaw 'Node2Shell'
Siemens ProductCERTSiemens, Node.jsCVE-2026-111497
What happened. On 21 October 2026 the Node.js project fixed a flaw in its Brotli decoder, called Node2Shell (CVE-2026-111497). A remote attacker could corrupt memory and possibly run code. Siemens reports which of its software products are affected.
Who is affected. Users of Siemens software products that bundle Node.js. The advisory lists the specific products.
What to do. Check the Siemens advisory SSA-045512 for which of your software products are affected, then apply the fixes or mitigations it gives.
When to act. Act today: on CISA's list of known exploited flaws
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: Siemens software products that bundle Node.js typically run on engineering workstations and site servers, so L2 and L3 are a reading; the report does not name the products.
- Are you exposed?
Compare your installed Siemens software against the product list in advisory SSA-045512 to see which bundle the affected Node.js component.
- If you cannot fix it yet
- Restrict network access to Siemens software that bundles Node.js to known client hosts.
- Keep affected Siemens servers off the internet and behind a firewall.
- Watch for
- Crashes or unexpected restarts of Node.js-based services in Siemens software.
- Unexpected child processes started by Node.js services on affected hosts.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Siemens ProductCERT (opens cert-portal.siemens.com)
More on Siemens CVE-2026-111497