CISA republishes Siemens advisory on critical Node.js Brotli flaw in Desigo, Gridscale

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has republished Siemens ProductCERT advisory SSA-045512 covering a critical Brotli decoder vulnerability bundled with Node.js that affects Siemens Desigo and Gridscale X products deployed in critical manufacturing, energy and IT sectors worldwide. The flaw permits remote unauthenticated code execution. Siemens has released fixed versions and sets out update and network-protection measures.

• CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js, rated CVSS v3.1 9.8 critical, allowing remote unauthenticated code execution via a crafted Brotli-compressed stream.
• Affected products are Desigo CC family V8, Desigo CC family V9, Gridscale X DSA (>=V5.3, <V5.4) and Gridscale X PSS®E (<V36.8.0), deployed worldwide in critical manufacturing, energy and IT sectors.
• Siemens remediations include installing the latest .NET security updates via Windows Update for Desigo CC, updating Gridscale X DSA to V5.4 or later, and updating Gridscale X PSS®E to V36.8.0 or later.
• The underlying Brotli flaw affects Google Brotli versions 1.0.3 through 1.2.0; users should update to 1.0.10, 1.1.1 or 1.2.1.
• CISA republishes the advisory verbatim from Siemens CSAF and states it is not responsible for its editorial or technical accuracy.

Executive summary

CISA on 12 November 2026 republished Siemens ProductCERT advisory SSA-045512 as ICS advisory ICSA-26-316-02, covering a critical vulnerability in the Brotli decoder bundled with Node.js. The flaw, tracked as CVE-2026-111497 and referred to as "Node2Shell", was addressed by the Node.js…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.