Node.js “Node2Shell” Brotli Decoder Flaw Enables Remote Code Execution Across All Supported Release Lines (CVE-2026-111497)

Scope: Node.js 22.x prior to 22.23.4, 24.x prior to 24.22.1, and 26.x prior to 26.12.1

Severity: Red

Node.js released coordinated security updates on October 21, 2026, addressing ten vulnerabilities, the most severe being CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled inside Node.js that can lead to memory corruption and remote code execution when an application decompresses Brotli-encoded data supplied by an attacker. Because the flaw lives in the Brotli library itself rather than in Node.js-specific code, it affects any software bundling the same decoder, not only Node.js applications directly, and Brotli compression is extremely common in both request bodies and fetched HTTP responses. Researchers have already begun calling this flaw Node2Shell given the parallel to PHP2Shell’s naming and impact pattern. The same release also fixed two high-severity TLS hostname verification bypasses (CVE-2026-105482 and CVE-2026-105483) that could allow certificate validation to be tricked using malformed hostname formats, along with seven lower-severity issues. Node.js 20 and earlier will not receive a fix, since those lines are end of life. Organisations running Node.js must update to version 22.23.4, 24.22.1, or 26.12.1 for their respective branch today, and any system still on Node.js 20 or earlier should be treated as a migration priority given it will never receive this patch.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.