Node.js Brotli flaw CVE-2026-111497 (Node2Shell) allows remote code execution, fix issued

Security outlets report a critical Node.js vulnerability in Brotli handling, dubbed Node2Shell, that allows remote code execution. Researchers reportedly demonstrated an exploit, and a fix is available.

Timeline

1. 23 Oct, 09:00 UTCFirst appeared on Google Trends
2. 23 Oct, 09:00 UTCPicked up on News
3. 23 Oct, 09:00 UTCCybernews reports critical Node.js flaw
4. 23 Oct, 09:00 UTCThe Hacker News covers RCE exploit demo
5. 23 Oct, 09:41 UTCPicked up on Mastodon

Top sources

• node2shellGoogle Trends
• For some reason, the CVE-2026-111497 buffer overflow vulnerability in the # brotli decoder is mostly associated with # nHarry Sintonen
• Node.js sounds the alarm: code used by Netflix has a critical flawCybernews
• Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataThe Hacker News
• Node.js fixes its own and inherited security vulnerabilitiesheise online