Node.js corrige falha de escrita fora dos limites no decodificador Brotli (CVE-2026-111497, "Node2Shell"), com PoC público; Bun também afetado
The Node.js Project released security updates on October 21, 2026 for the 26.x, 24.x and 22.x lines (26.12.1, 24.22.1, 22.23.4), fixing 10 vulnerabilities: four high, three medium and three low (gbhackers.com). The most serious is CVE-2026-111497, nicknamed Node2Shell (aikido.dev), an out-of-bounds write in the bundled Brotli decoder that…