CVE-2026-111497 Impact on Parallels RAS V19

R

RyanL23

Bit poster
Hi,

I am writing to seek clarification regarding the recently disclosed vulnerability CVE-2026-111497 (Node2Shell), which affects Node.js Brotli decoding. We would like to confirm whether this CVE has any impact on the current version of Parallels Remote Application Server (RAS) that we are using. The node.js application is found at "C:\Program Files (x86)\Paralells\ApplicationServer\2XHTML5Gateway\node.exe".

Specifically, we would appreciate your guidance on:
  • Whether our deployed RAS version relies on Node.js during operation.
  • If Node.js is used, which components or services within RAS are affected.
  • Whether the Node.js version bundled or required by RAS falls within the vulnerable range (22.x, 24.x, 26.x).
  • Any recommended patches, updates, or mitigation steps we should apply.
Your timely advice will help us assess potential risks and ensure our environment remains secure.

Thank you for your support.

Best regards, Ryan
 
Hi,

I'm having a support case open regarding Node2Shell but only response so far, that it got escalated.

User portal relays on Node.js. So disabling user portal for the secure gateways does stop the node.js process.

HTH

Best,
Jan
 
Hi Ryan,

I performed a few checks on a running Parallels RAS 21.2 environment. Here are the findings:

Node.js: v24.18.1
Brotli: 1.2.0
Component: 2XHTML5Gateway
Three active node.exe processes
TCP listener: 127.0.0.1:20020

According to the official Parallels port reference, TCP 20020 is used for communication between the RAS Secure Gateway and the Node.js-based User Portal.

This confirms that Node.js is actively used by RAS, rather than simply being an unused bundled component.

The installed Node.js version falls within the affected range for CVE-2026-111497.

However, this does not automatically confirm that the RAS User Portal is remotely exploitable. That would depend on whether attacker-controlled Brotli-compressed data reaches the vulnerable decoder.

For RAS 19 specifically, the release notes mention earlier Node.js versions, so the actual bundled version should be checked directly.

Parallels should ideally confirm which RAS versions/builds are affected and whether a security update or mitigation is required.

I would not recommend manually replacing the bundled Node.js executable without vendor validation.

Hope this helps.

Thierry
 
You must log in or register to reply here.
Back
Top