1-minute read
What a defender needs to know
Fortinet put FortiOS under investigation on October 26 while assessing ten Node.js vulnerabilities. Fortinet lists FortiManager, FortiAnalyzer, FortiWeb and other named products as confirmed unaffected, and says known exploitation in its advisory is “No.” The Node.js project has already released fixes for its 22.x, 24.x and 26.x lines. Treat these as two separate work queues: patch Node.js services you operate, and track Fortinet’s FortiOS finding before assigning an appliance fix.
The most consequential Node.js issue, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder. An application that decompresses attacker-supplied Brotli input through node:zlib can suffer a crash, memory disclosure or remote code execution. Other fixes address DNS NUL-byte name truncation, TLS checks on unusual IPv4 spellings, reused HTTP sockets, snapshot entropy caches, ZIP handling and Permission Model paths.
Compare the Node.js version in running services and packaged application images against first fixed builds 22.23.4, 24.22.1 and 26.12.1. Update older supported builds or move end-of-life releases to a maintained line. After rollout, verify the version reported by the running process matches the patched build, especially in services that decompress remote input. Record the installed FortiOS build and watch Fortinet’s advisory for its product-specific assessment before scheduling appliance remediation.