Brotli decoder out-of-bounds write (CVE-2026-111497, "Node2Shell"): Node.js, Bun and PyPI Brotli/brotlicffi affected; public PoCs, RCE shown on Node.js 24.22.0
The Node.js Project released security updates on October 21, 2026 for the 26.x, 24.x and 22.x lines (26.12.1, 24.22.1, 22.23.4), fixing 10 vulnerabilities: four high, three medium and three low (gbhackers.com). The most serious is CVE-2026-111497, nicknamed Node2Shell (aikido.dev), an out-of-bounds write in the bundled Brotli decoder that…