vDefend - Impact Evaluation for CVE-2026-111497 (Node2Shell)

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Network Detection and Response

Issue/Introduction

On October 21, 2026, Node.js disclosed the following vulnerability as part of its security update:

• CVE-2026-111497 – Node.js Brotli decoder out-of-bounds write permits remote code execution.

Environment

vDefend

• vDefend - vDefend Distributed Firewall, Gateway Firewall, IDPS with dependencies on VMware Cloud Foundation (VCF) - NSX Manager are not affected.
• Security Services Platform for vDefend 5.x - is not affected
• License Hub for vDefend and Avi 2.x - is not affected

Resolution

Product Resolution:

 

Not Affected: VMware vDefend components do not use Node.js and are not affected by this vulnerability.

Using VMware vDefend to detect CVE-2026-111497 exploitation attempts against your applications:

To detect CVE-2026-11497 exploitation attempts using VMware vDefend:

Enable VMware vDefend with IDS/IPS signatures specifically covering this vulnerability with the following signature IDs:

• Signature ID 1156325: detect CVE-2026-111497 exploitation attempts: https://appd.securityti.vmware.com/#/app/ids-signatures/detail?id=1156325&version=IDSSignatures_4034
• Signature ID 1156326: detect unusually large HTTP requests using Brotli (br) content encoding: https://appd.securityti.vmware.com/#/app/ids-signatures/detail?id=1156326&version=IDSSignatures_4034

Additional Information

VMware Avi Load Balancer - Mitigation for CVE-2026-111497 (Node2Shell) - https://knowledge.broadcom.com/external/article/460545