Security advisory: CVE-2026-111497 (Node2Shell) in the Desktop Client embedded browser

The Nx Witness Desktop Client on Windows, macOS, and Linux is affected by CVE-2026-111497, also known as Node2Shell. The vulnerability is in Brotli, a component that the Desktop Client's embedded browser uses to decompress web content. A malicious web response can crash the Desktop Client, expose process memory, or potentially let an attacker run code on the workstation.

Affected products and versions

The following component is affected:

• Desktop Client 6.1.2 and earlier 5.x and 6.x releases: Affected on Windows, macOS, and Linux. These releases include the vulnerable decoder through the Qt WebEngine.

The following components aren't affected, because they don't decode Brotli:

• Media Server: All supported server platforms.
• Server Web Admin: Not affected. Keep the separate browser you use to open Server Web Admin up to date according to its vendor's guidance.
• Mobile Client: All supported mobile platforms.
• Network Optix analytics plugins: All assessed Network Optix plugins. For third-party plugins, contact the plugin vendor.
• Nx Cloud: All assessed Nx Cloud services.

The Desktop Client assessment is based on its embedded browser dependency. 

How the vulnerability can be exploited

The vulnerable decoder is part of the Chromium-based browser that Qt WebEngine embeds in the Desktop Client. Despite the Node2Shell name, Nx Witness doesn't ship a Node.js runtime.

An attacker can't attack the Desktop Client directly over the network, because the Desktop Client doesn't accept incoming connections. Instead, the attacker must first control or compromise a web source that the Desktop Client loads, and then wait for a Desktop Client to load it. 

Possible sources include the following:

• A camera web page, if the camera is compromised
• A web server used in a Web Page layout item
• Content that an approved page loads from other websites, such as scripts, fonts, or images, including content reached through redirects

The attacker doesn't need VMS credentials. When an authorized user's Desktop Client loads the malicious content, e.g. camera web page, the attack runs inside that user's session. 

Keep the following points in mind:

• HTTPS doesn't prevent this attack. HTTPS protects content in transit, but it doesn't protect against a source that is itself malicious or compromised.
• The connection method doesn't change exposure. The risk is the same whether the Desktop Client connects to the Site over the local network, through port forwarding, or through Nx Cloud.
• Normal video doesn't use the embedded browser. Live viewing and playback don't load web content. The risk applies only when the Desktop Client displays a compromised web page.

Potential impact

Depending on how far an attack succeeds, an attacker could do the following:

• Crash the Desktop Client. If the malicious content loads automatically, the Desktop Client can crash every time it opens the page.
• Read Desktop Client memory. Exposed data could include page content, credentials, or session tokens.
• Run code on the workstation. In the worst case, the attacker's code runs with the permissions of the Desktop Client user. The attacker could then do anything that the user can do on the Site, such as view or export video, delete recordings, or change settings. With an administrator account, the attacker could also manage users and Site settings. The attacker could also steal stored credentials and use the workstation to reach other systems on the network. 

The CVE assigning authority rates the underlying vulnerability Critical (CVSS v4.0: 9.2). This rating applies to the upstream component and isn't a separate assessment of Nx Witness. The CVE record reports exploitation of the underlying vulnerability, but it doesn't report any exploitation involving Nx Witness.

Recommended mitigations

There's no supported Desktop Client setting to disable Brotli decoding. To reduce exposure until a fixed version is available, apply the following measures.

Limit web content in the Desktop Client

1. Open camera web pages only when you need them. Normal video viewing doesn't require the camera web page. If you can't trust a camera's web page, don't open it in the Desktop Client.
2. Review Web Page items in shared and saved layouts. Keep only operational pages from sources your administrator trusts.
3. Remove Web Page items that are unnecessary or unapproved, including pages that open at startup or refresh automatically.
4. Don't use the Desktop Client for general browsing, personal websites, or links received in messages or email. Use a separate, up-to-date browser instead, and follow your organization's browsing policy.

Secure the cameras and web sources

1. Place cameras on an isolated network that isn't reachable from the internet.
2. Keep camera firmware up to date, and replace default camera passwords.
3. Keep the web servers used in Web Page items maintained and up to date.
4. Review the redirects and external content that approved pages load. A familiar hostname alone doesn't guarantee safe content.
5. Use the permissions available in your deployment to limit who can add or change Web Page items and other operational web resources.

Restrict workstation access

1. Where practical, restrict outbound network traffic from operator workstations to the destinations that approved operational use requires, such as the Site's servers, cameras, and Nx Cloud.
2. Before you roll out outbound restrictions, verify that the Desktop Client can still reach the required cameras, servers, and Nx Cloud services.
3. Use accounts with the fewest permissions needed for day-to-day monitoring. Don't use administrator or Power User accounts for routine viewing.

Remediation status

As of November 6, 2026, Network Optix can't confirm a fixed Desktop Client version or release date yet. A fix depends on integrating and validating the upstream correction through Qt WebEngine. Network Optix will update this advisory when a fixed version is available.