Node.js Ecosystem Roundup: Node-RED Exploitation Reported, Cisco’s Brotli List and the 11 November Release

Six Node.js items arrived in the 24 hours to 4 November 2026. In order of urgency: Node-RED exploitation reported by VulnCheck, Cisco’s list of products hit by the Brotli bug, the 11 November Node.js release, a malicious npm package and two CVEs. The primary sources are listed at the end.

Node-RED: What Has VulnCheck Seen Exploited?

Siemens advisory SSA-834709 covers CVE-2026-58115, a missing-authentication flaw (CWE-306) in Node-RED on all four SIMATIC IoT2050 variants running Industrial OS below V4.3.4-1. Siemens scores it 10.0 under both CVSS 3.1 and CVSS 4.0, and says an unauthenticated attacker could create malicious flows and run code with maximum privileges. The fix is V4.3.4-1 or later; Siemens also lists uninstalling or hardening Node-RED. The advisory dates from 11 August 2026 and was revised on 4 November.

VulnCheck says its canary, a decoy system, caught an attacker exploiting the flaw on 30 October 2026. A single POST to /flows deployed an inject node wired to an exec node, which ran a layered base64 command that downloaded a Linux binary into a RAM-backed hidden path. On 1 November VulnCheck added a second dropper and persistent webshells, built from an HTTP input node wired through a function node to an exec node. VulnCheck did not retrieve the payloads.

The Node-RED user guide says the editor is not secured by default, so anyone who can reach it can deploy changes. VulnCheck points to the missing adminAuth setting as the exploited condition. Our reading, not Siemens’, is that any internet-reachable Node-RED editor deserves the same check, including copies embedded in other products.

Hunt for POST requests to /flows from non-administrator sources, flows that contain exec nodes or unexpected HTTP endpoints, and outbound wget or curl from the Node-RED process. In ATT&CK terms this is Exploit Public-Facing Application followed by shell execution (T1059.004), tool transfer (T1105) and a webshell (T1505.003), our mapping.

Cisco: Which Products Does the Brotli Flaw Reach?

Cisco advisory cisco-sa-oct2026-node-js-Jj3SQ19u reached version 1.5 on 4 November 2026. It lists four High CVEs: the Brotli decoder write CVE-2026-111497, DNS truncation with embedded NUL characters CVE-2026-105482, and two TLS hostname bypasses, CVE-2026-105483 and CVE-2026-106069. Cisco says proof-of-concept code is available and that it is not aware of malicious use against any Cisco product.

ISE, Secure Firewall Threat Defense and Catalyst SD-WAN are Not Impacted. IOS, IOS XE, IOS XR, NX-OS, Secure Firewall ASA and Management Center are still under investigation. Fixed rows include Duo Network Gateway 3.4.2, Duo Authentication Proxy Local Manager for Windows 6.8.1 (November 2026), Packet Tracer 9.2.0 (December 2026) and Catalyst Center 3.4.1 (July 2027).

CISA added CVE-2026-111497 to its KEV catalog on 27 October 2026 with a due date of 10 November. Our Node2Shell post and HTTP2Shell post cover the flaw itself.

Node.js: What Is Known About the 11 November Release?

The Node.js project says it will release new versions of the 22.x, 24.x and 26.x lines on or shortly after Wednesday 11 November 2026. The highest severity fixed is HIGH on each line. The pre-alert gives no CVE ids, counts or components, and says end-of-life versions are always affected.

Use the days before to inventory which services, build images and bundled products pin which Node.js line. In our view October showed the lag: Cisco’s list was still open two weeks after the 21 October release. See our October Node.js update post for that order of work.

@ubedsockets/baileys: What Does the Malicious Fork Do?

GitHub advisory GHSA-qwpw-cwrq-333j, published on 4 November 2026 from OpenSSF malicious-packages data, marks every version of the npm package @ubedsockets/baileys malicious. It is a trojanized fork of the Baileys WhatsApp library. On connection it sends an authenticated newsletter FOLLOW request that subscribes the victim to attacker-controlled WhatsApp channels, using two hardcoded channel IDs.

The advisory lists individual versions from 1.0.0 to 1.7.12, says all published versions are malicious and names no patched version. It describes the channel subscription only. Our advice: search lockfiles and images for the @ubedsockets scope, remove it, and re-link any WhatsApp session it ran in. This is a case of Compromise Software Supply Chain.

Elo and Moleculer: How Do the Two Library CVEs Compare?

For Elo, the advisory says three code sites combine. The transform step does not filter property names, the emitter writes them out unescaped, and the parser accepts constructor as a plain identifier. The result is arbitrary code in the host runtime through the parse API or the command-line tool. The browser playground is open to script injection, and GitHub credits ultra-supara.

For Moleculer, the TCP transporter’s packet parser reads a signed length, and a negative value leaves a loop running forever. That blocks the event loop and freezes every service in the process until restart. Neither CRC validation nor maxPacketSize stops it. Neither record carries a CVSS 4.0 score.