Node.js Brotli decoder flaw Node2Shell (CVE-2026-111497) now exploited in the wild
Node2Shell (CVE-2026-111497), an out-of-bounds write in the Brotli decoder bundled with Node.js, is under active exploitation and CISA added it to KEV on October 27. Any app that decompresses attacker-supplied Brotli data is exposed. Move to Node.js 22.23.4, 24.22.1 or 26.12.1, then restart processes and rebuild images.
CVE-2026-1114973 min