Hi,
I am writing to seek clarification regarding the recently disclosed vulnerability CVE-2026-111497 (Node2Shell), which affects Node.js Brotli decoding. We would like to confirm whether this CVE has any impact on the current version of Parallels Remote Application Server (RAS) that we are using. The node.js application is found at "C:\Program Files (x86)\Paralells\ApplicationServer\2XHTML5Gateway\node.exe".
Specifically, we would appreciate your guidance on:
Thank you for your support.
Best regards, Ryan
I am writing to seek clarification regarding the recently disclosed vulnerability CVE-2026-111497 (Node2Shell), which affects Node.js Brotli decoding. We would like to confirm whether this CVE has any impact on the current version of Parallels Remote Application Server (RAS) that we are using. The node.js application is found at "C:\Program Files (x86)\Paralells\ApplicationServer\2XHTML5Gateway\node.exe".
Specifically, we would appreciate your guidance on:
- Whether our deployed RAS version relies on Node.js during operation.
- If Node.js is used, which components or services within RAS are affected.
- Whether the Node.js version bundled or required by RAS falls within the vulnerable range (22.x, 24.x, 26.x).
- Any recommended patches, updates, or mitigation steps we should apply.
Thank you for your support.
Best regards, Ryan