Tanzu Node.js Vulnerabilities CVE-2026-111497
Article ID: 460898
Updated On:
Products
Issue/Introduction
On 10/22/26 a critical memory corruption vulnerability (known as Node2Shell) was discovered in Node.js and rated CVSSv4 (Common Vulnerability Scoring System) 9.2. If exploited, an attacker can execute arbitrary code on the host system, cause a DoS attack or leak critical and sensitive information out of the system.
The Tanzu division initiated the incident response process immediately upon receiving the Node.js advisory. Pipelines started releasing fixes within the hour and all Tanzu and TrueSource products were fully patched by the end of the day.
Components of Tanzu Platform and Tanzu Data Intelligence are affected by this issue as well as the application components such as buildpacks, TrueSource artifacts, etc which developers use to develop and deploy Node.js apps.
For all customers running Node.js workloads on platform all necessary patches have been released through the Node.js buildpacks and can be easily rolled out for all applications via the cf restage command.
For customers leveraging TrueSource Trusted Artifacts or Bitnami Secure Images, all Node.js related images were promptly patched.
Customers who have applied the patches are not vulnerable to the Node.js exploits. To ensure all environments are fully protected against these vulnerabilities, customers must update their deployments to the latest patched versions immediately.
The vulnerabilities:
- CVE-2026-111497 - https://nvd.nist.gov/vuln/detail/cve-2026-111497
Environment
Impacted Products
- Tanzu Platform
- Node.js Buildpack (in Elastic Application Runtime for VMware Tanzu Platform)
- Elastic Application Runtime for VMware Tanzu Platform
- Foundation Core for VMware Tanzu Platform
- Ubuntu Jammy Stemcells
- Tanzu Hub
- Platform Services for VMware Tanzu Platform
- TrueSource Trusted Artifacts (and Bitnami Secure Images):
- Node.js 22 container image
- Node.js minimal 22 container image
- Node.js 24 container image
- Node.js minimal 24 container image
- Node.js 26 container image
- Node.js minimal 26 container image
- Tanzu Application Platform
- Node.js Cloud Native Buildpack
Resolution
Upgrade to latest patch release
- Tanzu Platform Node.js Buildpack
- Node.js Buildpack Fixed in 1.9.25
- TrueSource images for Node.js:
- Node.js 22 container image fixed in 22.23.4
- Node.js minimal 22 container image fixed in 22.23.4
- Node.js 24 container image fixed in 24.22.1
- Node.js minimal 24 container image fixed in 24.22.1
- Node.js 26 container image fixed in 26.12.1
- Node.js minimal 26 container image fixed in 26.12.1
- Upgrade to the latest Truesource images from Bitnami to fix the vulnerabilities.
- Tanzu Application Platform (TAP) Node.js Cloud Native Buildpack:
- Fixes delivered 6.3.2 is the CNB version for TAP/TBS
- Upgrade Tanzu Hub Tile and Platform Services tile to versions 10.4.7 or 11.0.1
- Jammy stemcell 1.9056
- Tanzu foundation core v3.1.17, v3.3.8, v11.0.1
Deploy Updated Foundation Core
While the foundation core VM is not believed to be directly vulnerable or exploitable, optionally updating to the late October patches of Foundation Core is recommended for full completeness of remediation as there is a node application running on the vm. This update carries significantly lower security benefits compared to updating buildpacks.
Bump the Jammy stemcell on all Tiles
The stemcell is not believed to be directly vulnerable or exploitable, however the stemcell does include an impacted brotli package. No Broadcom shipped software has been identified as using the package. The patched brotli package was shipped in 1.9056
Feedback
