Vulnerability

Philips lists PIC iX 4.x in its Node2Shell advisory and makes customers responsible for mitigations

MedDevice Cyber Staff · 5 days ago · 3 min read · Via Philips product security advisories

Philips listed PIC iX 4.x (product 866389) in a Node2Shell advisory published and last updated on October 26. The advisory covers CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x. Philips gives no CVSS score and names no fixed version. It says it is monitoring developments and evaluating the best possible mitigations for the listed product.

The footnote carries the weight. PIC iX 4.x is a software-only product that runs on a customer-owned operating system, and Philips says customers are responsible for applying the applicable mitigations. To the best of its knowledge, Philips says, the list is complete and products not listed should be considered not impacted.

The Node.js project's October 21 security releases fix the bug in versions 26.12.1, 24.22.1, and 22.23.4, and rate CVE-2026-111497 High. An invalid block switch was treated as a request for more input, so the streaming decoder kept appending bytes to an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. Node.js says that can lead to a crash, disclosure of process memory, or remote code execution. OpenAI Codex Security reported the bug.

Contrast Security's October 23 analysis calls Express 5 and body-parser 2.x the known path, since they decompress request bodies sent with Content-Encoding br. It names two other routes: a malicious response decoded by fetch(), and a direct call to zlib.brotliDecompress(). Contrast says exploitation details are not public and Node.js has published no workaround, and that end-of-life lines are affected and will get no fix. PHP.net also rebuilt its Windows PHP builds on October 26 with Brotli 1.2.1, which it says fixes CVE-2026-111497. A product that bundles Brotli, directly or through a runtime, should show it in the SBOM.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update every Node.js service you ship or host to 26.12.1, 24.22.1, or 22.23.4. End-of-life lines are affected and receive no fix, so they need a runtime upgrade. Philips names no fixed version for PIC iX 4.x and puts mitigation on the customer, so owners of that product should watch the advisory for updates. Contrast Security advises reviewing logs from October 21 onward.

Upgrade the Node.js runtime. Move to 26.12.1, 24.22.1, or 22.23.4. Lines past end of life are affected and will not receive a fix.
Find every route to the decoder. Contrast describes Express 5 and body-parser 2.x request decompression as the known path, with fetch() and direct zlib.brotliDecompress() calls as other routes. Search your code and dependencies for all three.
Review logs from October 21 onward. Contrast says Node.js has published no workaround or indicators of compromise. It advises checking application logs and endpoint telemetry from the release date for signs of compromise.
Look for Brotli outside Node.js. PHP.net rebuilt its Windows PHP builds on October 26 with Brotli 1.2.1, which it says fixes CVE-2026-111497. Search your SBOM for other components that bundle Brotli.
Tell customers who owns the runtime. For software-only products on customer-owned operating systems, state which Node.js versions the product uses and who applies the update, before an advisory forces the question.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

PIC iX

PID-31 PID-312 Off-the-shelf software Named operating system

Fix the class in your product

The advisory is not for a bug you wrote; it is in a component you embed. As the maker, pin dependencies to fixed versions, generate an SBOM on every build including transitive components, and gate the pipeline on known-vulnerable components so an advisory maps to your products automatically.

Pin and inventory. Exact versions, and a CycloneDX or SPDX SBOM as a build artifact including transitive deps.
Gate on advisories. A CI scan fails a release carrying a component with a known advisory.
Own the field patch path. Know how you deliver a dependency or platform patch to fielded devices before you need it.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-111497, the Node2Shell flaw in Node.js?

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x, rated High by the Node.js project. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.

Does Philips list PIC iX in its Node2Shell advisory?

Yes. Philips listed PIC iX 4.x (product 866389) in its Node2Shell advisory, published and updated October 26, 2026. PIC iX 4.x is software only and runs on a customer-owned operating system, and Philips says customers are responsible for applying the applicable mitigations. The advisory names no fixed version. Philips says that to the best of its knowledge the list is complete.

Which Node.js versions fix CVE-2026-111497?

Node.js fixed CVE-2026-111497 in 26.12.1, 24.22.1, and 22.23.4, part of its security releases dated October 21, 2026. Contrast Security says end-of-life Node.js versions are affected and will not receive a fix.

← Back to Vulnerabilities