A high-severity Node.js vulnerability affected some ASCA Discord bot services. All affected services are patched, potentially exposed credentials have been rotated, and we have found no evidence of compromise.
- Published: October 23, 2026
- Severity: High
- Status: Resolved — No Evidence of Compromise
On October 21, 2026, ASCA and Orange Airsoft Club (OAC) were notified of CVE-2026-111497, a high-severity security vulnerability affecting the Brotli decompression component in Node.js. Under certain conditions, this vulnerability could allow an attacker to execute unauthorized code on affected systems.
Following the disclosure, our security team initiated an investigation to assess potential exposure across our infrastructure and services.
Impact and Remediation
Our investigation identified that certain ASCA Discord bot services were running affected versions of Node.js and may have been vulnerable to exploitation prior to remediation.
ASCA's managed infrastructure utilizes automated security updates, and all identified affected services have since been updated to patched versions of Node.js.
As an additional precaution, ASCA and OAC have rotated all potentially exposed credentials to mitigate the risk of unauthorized access, even though no evidence of compromise has been identified.
To expedite remediation, we also accelerated several previously planned service and infrastructure upgrades. Details regarding new features and improvements will be announced separately.
Investigation Findings
Our security review included an examination of available system logs, running processes, and service activity for potential indicators of compromise.
As of this notice, we have found no evidence of successful exploitation, unauthorized access, data breaches, or other suspicious activity associated with this vulnerability.
Although no indicators of compromise have been identified, the available evidence cannot conclusively rule out historical exploitation.
At this time, all services remain operational, and there is no evidence that user information has been compromised.
Continued Monitoring
ASCA and OAC remain committed to protecting the security and privacy of our users, members, and communities.
We will continue monitoring all ASCA services and infrastructure for unusual activity and potential security threats. Our security team will assess any new findings and take additional action when necessary.
We are publishing this advisory as part of our commitment to transparency and responsible security practices. Should our investigation identify any impact on users, we will provide further updates as appropriate.
Questions or Security Concerns
For questions, concerns, or additional information regarding this advisory, please contact:
ASCA Cybersecurity Division
Email: [email protected]
We appreciate your continued trust and support.
References
ASCA & Orange Airsoft Club
October 23, 2026