Zowe Response to Recent Industry Vulnerabilities

Published: October 2026 | Zowe Security Workgroup

Zowe Community Security Advisory: The Zowe project is actively responding to two recent industry-wide security issues impacting common runtimes: the eMudhra intermediate Certificate Authority (CA) compromise and the Brotli "node2shell" vulnerability (CVE-2026-111497). Upgrading your Node.js runtimes to the latest maintenance releases resolves both vulnerabilities simultaneously across affected components.

Overview of Vulnerabilities

eMudhra Certificate Authority Compromise: Multiple intermediate CAs operated by eMudhra were compromised due to weak cryptographic key generation. Runtimes and system trust stores must be updated to ensure these intermediate CAs are distrusted or removed.
Brotli "node2shell" Vulnerability (CVE-2026-111497): An out-of-bounds write flaw in the native Brotli decoder bundled with Node.js can lead to memory disclosure, crashes, or potential remote code execution when decompressing malformed Brotli data.

Recommended Actions

1. Upgrade Node.js Runtimes

Upgrading Node.js addresses both the eMudhra root store distrust and the Brotli (node2shell) vulnerability. Node.js versions earlier than 26.12.1, 24.22.1, and 22.23.4 are vulnerable. Users of Zowe CLI and server-side Node.js components should upgrade their Node.js runtimes to the patched versions immediately:

Node.js v26: Upgrade to >= 26.12.1
Node.js v24: Upgrade to >= 24.22.1
Node.js v22: Upgrade to >= 22.23.4

For users of Zowe Explorer, update your VS Code environment to 1.143.1 or later.

2. Update Java / JVM Environments

Ensure that Java runtime environments (JRE/JDK) powering the Zowe API Mediation Layer and other Java services on z/OS have received the latest security updates from IBM's Java distribution to ensure root certificates and trust stores remain secure.

3. Inspect Custom Truststores and Keyrings

If you have any eMudhra certificate authorities in your z/OS keyrings or custom enterprise truststores, remove them and restart Zowe.