Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

A critical remote code execution vulnerability (CVE-2026-111497) was discovered in the Brotli decoder bundled directly within official Node.js builds, meaning every unpatched Node.js installation carries the flaw by default. Attackers can trigger arbitrary code execution simply by delivering crafted Brotli-compressed data—no special access, debugger, or custom build required—dramatically lowering the barrier to exploitation. This matters because Node.js is ubiquitous in production environments, and a single unpatched runtime across thousands of deployed services creates a massive attack surface. The incident also highlights the compounded risk of bundled third-party libraries: organizations may not realize their Node.js runtime itself is the vulnerable component, causing it to be overlooked in standard dependency scanning workflows.