Security Ledger · October 2026
Vulnerability & Advisory Index
Verified Common Vulnerabilities and Exposures across server runtimes, language toolchains, and enterprise cryptography stacks, indexed with affected branches and upstream patch releases.
| Identifier | Component / Vector | Severity | Affected Branches | Patched Release | Analysis |
|---|---|---|---|---|---|
| CVE-2026-111497 | Node.js Brotli Stream Decoder | CRITICAL · 9.8 | 20.x, 22.x, 24.x, 25.x | v20.20.4, v22.22.4, v24.16.0, v25.10.0 | Read → |
| CVE-2026-109618 | PHP SAPI Multipart Parser (php2shell) | CRITICAL · 9.2 | 8.2.x < 8.2.28, 8.3.x < 8.3.19, 8.4.x < 8.4.6 | PHP 8.2.28, 8.3.19, 8.4.6 | Read → |
| GHSA-cf8x-9m69 | Bun HTTP/3 QPACK Decoder | HIGH · 9.2 | Bun < v1.4.4 | Bun v1.4.4 | Read → |
| CVE-2026-91403 | Oracle Java SE / GraalVM JSSE TLS | CRITICAL · 9.1 | JDK 8u431, 11.0.25, 17.0.13, 21.0.5, 25.0.1 | Oracle Out-of-Band Security Alert Patch | Read → |
| CVE-2026-111500 | Node.js TLS ALPN Callback Race | HIGH · 8.1 | Node.js 22.x, 24.x, 25.x | v22.22.4, v24.16.0, v25.10.0 | Read → |
| CVE-2026-111508 | Node.js Permission Model FS Bypass | HIGH · 7.7 | Node.js 20.x, 22.x, 24.x, 25.x | v20.20.4, v22.22.4, v24.16.0, v25.10.0 | Read → |
| GHSA-54x7-74r2 | Bun Node.js Brotli Stream Port | HIGH · 7.5 | Bun < v1.4.4 | Bun v1.4.4 | Read → |
| CVE-2026-111510 | Node.js HTTP/2 CONTINUATION Flood | HIGH · 7.5 | Node.js 20.x, 22.x, 24.x, 25.x | v20.20.4, v22.22.4, v24.16.0, v25.10.0 | Read → |
| CVE-2026-111498 | Node.js llhttp Chunked Extension Smuggling | MEDIUM · 6.5 | Node.js 20.x, 22.x, 24.x, 25.x | v20.20.4, v22.22.4, v24.16.0, v25.10.0 | Read → |
Security Dispatches & Post-Mortems
