Node2Shell: Brotli decoder out-of-bounds write in Node.js and Bun (CVE-2026-111497) enables potential RCE; patches released
Node.js released security updates on October 21, 2026 for CVE-2026-111497 (nicknamed Node2Shell), an out-of-bounds write in the bundled Brotli decoder. Malformed compressed input can crash the process, leak memory or potentially give an attacker code execution. Node.js rates it high severity, and Bun is also affected. A public proof of co…