Published: October 29, 2026
Last updated: November 11, 2026
Upstream severity: Critical (NVD CVSS 3.1 base score 9.8 for CVE-2026-111497)
Products assessed: The Transpara platform (release 2.5.1) and Transpara Windows products
Status: Fixed in Transpara platform release 2.7.7 (published November 9, 2026)
Update: November 11, 2026
Transpara platform release 2.7.7, published November 9, 2026, addresses this vulnerability in the affected platform components. We verified the Node.js runtime inside each released image:
- Memgraph Lab 3.14.1: Node.js 24.22.1
- Transpara tStudio 1.56.0: Node.js 24.22.1
- Transpara tView 0.238.0: Node.js 24.22.1
- Transpara tai-gateway 1.5.0: Node.js 22.23.4
Customers should upgrade to release 2.7.7. Workstations using the Transpara Excel Add-in also need .NET 8 Desktop Runtime 8.0.33 or later (see section 2).
Overview
Transpara has assessed CVE-2026-111497, also known as Node2Shell, a critical vulnerability in the Brotli decompression library used by Node.js and other software runtimes. Software that decompresses specially crafted, attacker-controlled Brotli data may be exposed to memory corruption, denial of service, information disclosure, or potentially remote code execution.
Our review identified vulnerable runtime versions in certain components used by the Transpara platform. The presence of a vulnerable runtime does not by itself mean that a component can be exploited through an unauthenticated incoming request. Exposure depends on whether untrusted compressed data can reach the affected decoder.
The most direct potentially exposed path identified in our assessment is in Memgraph Lab, a third-party application deployed alongside the platform. The affected Transpara components have a more limited exposure, through compressed responses they receive from other services. Upstream fixes are available for all of them, and Transpara platform release 2.7.7 includes the corresponding updates.
1. Affected components and exposure
| Component | Version assessed | Assessment |
|---|---|---|
| Memgraph Lab (third-party software by Memgraph) | 3.13.1 (Node.js 24.20.0) | Highest remediation priority. Its HTTP request handling can decompress Brotli-encoded request bodies before application-level authentication when its gateway route is reachable. |
| Transpara tStudio | 1.51.0 (Node.js 24.18.0) | Vulnerable runtime. Potential exposure through Brotli-compressed responses received from configured upstream services. No unauthenticated inbound decompression path was identified. |
| Transpara tView | 0.227.0 (Node.js 24.19.0) | Vulnerable runtime, with the same outbound-response exposure as tStudio. |
| Transpara tai-gateway | 1.4.0 (Node.js 22.23.2) | Vulnerable Node.js runtime used only by a bundled command-line tool. Potential exposure through responses from the external endpoints that tool is configured to call. |
| Transpara Excel Add-in | Workstations running a .NET 8 Desktop Runtime earlier than 8.0.33 | Conditional exposure when the add-in processes attacker-controlled Brotli-compressed responses. |
Memgraph Lab: third-party software deployed from Memgraph’s own distribution
Memgraph Lab is a graph visualization and administration application developed, licensed and distributed by Memgraph. It is not a Transpara product. Transpara does not build, modify or package Memgraph Lab, and the Transpara installer does not ship it. The installer deploys Memgraph’s official container image (memgraph/lab on Docker Hub): in connected installations the image is pulled directly from Docker Hub during installation and upgrades, and in air-gapped installations the customer obtains the image from Docker Hub and supplies it to the installer. Use of Memgraph Lab is subject to Memgraph’s own license terms.
Memgraph Lab and the Memgraph database are different products. The Memgraph database, which the platform uses as its graph database and which is deployed in the same way (from Memgraph’s official image, not shipped by Transpara), does not include Node.js and is not part of this finding. Like several other images in the platform, its base operating system includes a Brotli library; no network-reachable decompression path was identified for it (see “Other dependencies” below).
Because the installer deploys Memgraph Lab by default and publishes it through the platform gateway, Transpara includes it in this assessment and in its remediation plan. Our review found that Memgraph Lab 3.13.1 can decompress Brotli-encoded HTTP request bodies before application-level authentication. If its route is reachable through the platform gateway, an unauthenticated client may be able to reach the vulnerable decoder.
Memgraph published Memgraph Lab 3.14.1 on October 26, 2026. It contains a patched Node.js runtime (24.22.1), which we verified by inspecting the published image. Memgraph Lab 3.14.0 still contains the vulnerable runtime and is not sufficient. Transpara is updating the installer to deploy Memgraph Lab 3.14.1.
Transpara tStudio, tView and tai-gateway
The Node.js runtime in these components can decompress Brotli data received in HTTP responses from other services. Our code and configuration review did not identify any path by which an unauthenticated inbound HTTP request is decompressed by the vulnerable decoder in these services. Exploitation through the identified outbound paths would require an attacker to control, or intercept, a response from a configured upstream service.
Windows products and other dependencies
Transpara Windows services built on .NET Framework 4.x were assessed and are not affected by this vulnerability, because .NET Framework does not include a Brotli decoder. The Transpara Excel Add-in runs on .NET 8 and may be affected on workstations with an unpatched .NET 8 Desktop Runtime. Microsoft has published the fix in .NET 8.0.33.
Our assessment also identified Brotli libraries in operating-system packages and third-party dependencies of several platform images. No attacker-controlled decompression path was identified for these components under the configurations reviewed. The relevant updates will be included in normal maintenance releases.
2. Patches and remediation
Transpara platform release 2.7.7 (published November 9, 2026) includes the following fixes. We verified the Node.js runtime inside each released image.
| Component | Fix |
|---|---|
| Memgraph Lab | The installer now deploys Memgraph Lab 3.14.1 (Node.js 24.22.1), the fixed release published by Memgraph (Helm chart memgraph-lab 1.0.6). |
| Transpara tStudio | tStudio 1.56.0, built on Node.js 24.22.1. |
| Transpara tView | tView 0.238.0, built on Node.js 24.22.1. |
| Transpara tai-gateway | tai-gateway 1.5.0, built on Node.js 22.23.4. |
| Transpara Excel Add-in | Update affected workstations to .NET 8 Desktop Runtime 8.0.33 or later; update the add-in installer accordingly. |
Customers should upgrade to release 2.7.7 through the normal Transpara installer upgrade process (see section 4).
3. Recommended interim mitigations
Until release 2.7.7 is installed, customers should take the following precautions:
- Restrict or disable access to Memgraph Lab. Where it is not required, remove or restrict its route on the platform gateway (path prefix
/tgraph/lab) or scale the Memgraph Lab deployment to zero. Where it remains in use, limit access to authorized administrators on trusted networks. - Limit gateway exposure. Restrict access to administrative services through the platform gateway using appropriate network security controls.
- Protect upstream communications. Limit connections to trusted upstream services and authorized external endpoints.
- Update the .NET runtime. Workstations using the Transpara Excel Add-in should install .NET 8 Desktop Runtime 8.0.33 or later.
These measures reduce exposure until the upgrade is completed.
4. Deployment requirements
The platform fixes are deployed through the normal Transpara installer upgrade process. Updated container images replace the affected components, and their Kubernetes workloads restart as part of a rolling update.
- No server reboot or platform-wide planned downtime is anticipated under normal deployment conditions. Individual affected pods will restart.
- Connected installations pull the updated Memgraph Lab image from Docker Hub, as they do today.
- Air-gapped installations also need to obtain the updated Memgraph Lab image from Docker Hub with the installer’s image fetch script, as for any Memgraph update.
- The Excel Add-in requires an updated .NET 8 Desktop Runtime on each applicable Windows workstation, followed by an Excel restart.
Customer-specific infrastructure and configuration may affect the deployment procedure.
5. Assessment scope and limitations
The assessment covered the container images referenced by Transpara platform release 2.5.1 (including the third-party Memgraph Lab and Memgraph database images), the corresponding development manifest, relevant application source code and configuration, and the applicable Windows products. It included runtime version inspection inside each image, source code and configuration review, and vulnerability-scanner cross-checks.
No exploit was executed against any component. Exposure conclusions are based on image, source code and configuration review rather than demonstrated exploitation. Results may differ for customer-specific configurations or for installations outside the reviewed scope.
Validated fixes are now available in Transpara platform release 2.7.7.
References
- Node.js security releases, October 21, 2026
- NVD: CVE-2026-111497
- CISA Known Exploited Vulnerabilities Catalog
- Microsoft .NET 8.0.33 release notes
- Memgraph release notes (Memgraph Lab 3.14.1)
- Memgraph Lab official container image on Docker Hub
Customer support
Customers with questions about their deployment, temporary mitigations, or applying the security updates should contact Transpara through their established support channels or by email at support@transpara.com.
Revision history
- October 29, 2026: Initial publication.
- November 11, 2026: Fix available in Transpara platform release 2.7.7. Updated status, fixes and guidance.