[Quickbase Status] Notice: Node.js Vulnerability (Informational)

Informational
10/27/2026, 03:01pm EDT

[Quickbase Status] Notice: Node.js Vulnerability (Informational)

Status: closed
Date: 10/27/2026, 03:00pm EDT
Affected Components:
Quickbase Service - US Region Quickbase Service - EU Region Quickbase Pave - US Region Quickbase Community Quickbase Company Website Quickbase Help Quickbase Support Portal Quickbase University Quickbase Audit Logs - US Region Quickbase Audit Logs - EU Region Quickbase Automations - US Region Quickbase Billing - EU Region Quickbase Billing - US Region Quickbase Extensions - EU Region Quickbase Fastfield - EU Region Quickbase Extensions - US Region Quickbase Pipelines - EU Region Quickbase Fastfield - US Region Quickbase Pipelines - US Region Quickbase Platform Analytics - EU Region Quickbase RESTful APIs - EU Region Quickbase Platform Analytics - US Region Quickbase RESTful APIs - US Region Quickbase Sync - EU Region Quickbase Sync - US Region Quickbase Webhooks - EU Region Quickbase Webhooks - US Region
Update

10/27/2026, 03:00pm EDT

10/27/2026, 03:00pm EDT

Regarding the recently reported Node.js vulnerability, tracked as CVE-2026-111497 (dubbed "Node2Shell" or "Broccoli2Shell"), affected versions of Node.js, the .NET runtime and the Google Brotli library are present in parts of Quickbase's infrastructure.  One internet-facing supporting service was found to have a path to the vulnerable code.  A fix for it has been developed and is being deployed as a priority.  The core Quickbase platform cannot be exploited in its current production configuration.  Components where the vulnerable code cannot be reached are also being updated to patched versions, in line with our standard vulnerability management practices.  The investigation is ongoing, and new findings are triaged and escalated for remediation as soon as they are identified.  Quickbase is not aware of any exploitation of this vulnerability, and no customer action is required.