Node.js Brotli flaw CVE-2026-111497 (Node2Shell) allows remote code execution, fix issued

Security outlets report a critical Node.js vulnerability in Brotli handling, dubbed Node2Shell, that allows remote code execution. Researchers reportedly demonstrated an exploit, and a fix is available.

Timeline

1. 23 Oct, 09:00 UTCFirst appeared on Google Trends
2. 23 Oct, 09:00 UTCCybernews reports critical Node.js flaw
3. 23 Oct, 09:00 UTCThe Hacker News covers RCE exploit demo

Top sources

• node2shellGoogle Trends
• Node.js sounds the alarm: code used by Netflix has a critical flawCybernews
• Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataThe Hacker News
• Node.js fixes its own and inherited security vulnerabilitiesheise online