CVE-2026-111497 security flaw

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code. Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

Published 22-Oct-2026 19:44 UTC · First seen 22-Oct-2026 19:43 UTC

Sources

• Aikido Security's Blog · 22-Oct-2026