Back to advisories

Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines

Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.

CRITICALCVEOct 23, 2026

What to do now: the commands, how to hunt for it and what does not help →

Action required

Updating npm deps does not fix this. The bug is in the bundled runtime. Patch Node itself, in containers and SEAs too.

Affected products

Node2Shell

CVE IDs

CVE-2026-106069 CVE-2026-105483 CVE-2026-105482 CVE-2026-106074 CVE-2026-111497 CVE-2026-105481 CVE-2026-106072 CVE-2026-106070 CVE-2026-106071 CVE-2026-106073 CVE-2026-109618 CVE-2026-109619

Linked articles

Source links

https://threatnoir.com/blog/node2shell-node-js-brotli-decoder-rce-cve-2026-111497