Update on Node2Shell Vulnerability (CVE-2026-111497)
On Wednesday, 21 October, a critical security vulnerability was publicly disclosed in Node.js, a widely used technology on which several Prowise services depend. The vulnerability, known as Node2Shell, could potentially allow attackers to execute unauthorised code.
Following the disclosure, we immediately assessed the potential risks to our services. On Thursday, 22 October, we implemented initial mitigating measures while our technical teams also continued prioritising the restoration of services affected by the previously reported PHP2Shell vulnerability.
On Friday, 23 October, we implemented security updates across most affected systems, further addressing the identified risks.
We have observed no indications that our services were compromised. Our precautionary measures were taken to safeguard the confidentiality and integrity of customer data.
Unlike PHP2Shell, we were able to mitigate the risks without taking any services offline. Our services remained available throughout these security activities.
Protecting customer data remains a priority, and we continue to monitor security developments and take appropriate measures when vulnerabilities are identified.
For questions and the latest updates, please visit service.prowise.com.