Vulnerabilities
Node2Shell Brotli Flaw (CVE-2026-111497) Triggers Node.js Patch Push After RCE Demo
A high-severity out-of-bounds write in the Brotli decoder bundled with Node.js has been shown to allow remote code execution on stock Node.js builds. Fixes shipped October 21 in Node.js 22.23.4, 24.22.1 and 26.12.1.