Siemens has added Desigo CC and two Gridscale X products to its advisory on "Node2Shell," a critical flaw in the Brotli decoder bundled with Node.js.
The Node.js project released fixes on October 21 for CVE-2026-111497. It is an out-of-bounds write, meaning code writes data past the end of the memory it was given, in the part of Node.js that decompresses Brotli data. A remote attacker could corrupt memory and potentially run arbitrary code. The flaw scores 9.8 out of 10 on the CVSS severity scale. Its vector shows it is reachable over the network, needs no privileges, and needs no user interaction.
Siemens published its advisory on October 30. On November 4 it added Desigo CC, listing all versions of V8 and V9. On November 6 it added Gridscale X DSA (V5.3 up to, but not including, V5.4) and Gridscale X PSS®E (anything before V36.8.0). The fixes are V5.4 or later for DSA and V36.8.0 or later for PSS®E. The text lists no fixed version for Desigo CC, though Siemens said it has released new versions for the affected products and recommends updating to the latest.
The Gridscale entries carry both known_affected and known_not_affected statuses, so the advisory does not say every configuration is vulnerable. Operators need to check their exact product and version against it.
The timeline is the useful part. The list grew 5 and 7 days after publication, which is 14 and 16 days after the upstream fix. Anyone who read the October 30 version and moved on had an incomplete picture, so it is worth rechecking.
Siemens also told operators of critical power systems that grid designs with redundant secondary protection limit the effect of cyber incidents on reliability. That is the company's own framing. It recommends validating updates before applying them, supervision by trained staff, and keeping network access behind firewalls, segmentation or VPNs.
The advisory does not say whether anyone has exploited the flaw.