Synology-SA-26:15 Node2Shell

Publish Time: UTC+8

Last Updated: UTC+8

Severity
Moderate
Status
Ongoing

Abstract

A vulnerability allows remote attackers to execute arbitrary code via susceptible versions of the following products:
    • DSM packages:
      • Synology Application Service
      • Synology Calendar
      • Synology Chat Server
      • Synology Contacts
      • Synology Drive Server
      • Synology MailPlus
      • Synology Meet
      • Synology Office
      • Synology Photos
    • SRM package:
      • VPN Plus Server
    • Desktop utilities:
      • Note Station Client
      • Synology Chat Client
      • Synology Chatplus Client

Please refer to the ‘Affected Products’ table for the corresponding updates.

Affected Products

Product Severity Fixed Release Availability
Synology Application Service Not affected N/A
Synology Calendar Not affected N/A
Synology Chat Server Not affected N/A
Synology Contacts Not affected N/A
Synology Drive Server Not affected N/A
Synology MailPlus Not affected N/A
Synology Meet Not affected N/A
Synology Office Not affected N/A
Synology Photos Not affected N/A
VPN Plus Server Not affected N/A
Note Station Client Not affected N/A
Synology Chat Client Moderate OnGoing
Synology Chatplus Client Moderate OnGoing

Mitigation

None

Detail

  • CVE-2026-111497
    • Severity: Critical
    • CVSS3 Base Score: 9.8
    • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • CWE-252: Unchecked Return Value
    • A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

Reference

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Revision

Revision Date Description
1 2026-10-29 Initial public release.