Node.js fixes out-of-bounds write in Brotli decoder (CVE-2026-111497, "Node2Shell"); public PoCs, RCE shown on official 24.22.0 build; Bun also affected
The Node.js Project released security updates on October 21, 2026 for the 26.x, 24.x and 22.x lines (26.12.1, 24.22.1, 22.23.4), fixing 10 vulnerabilities: four high, three medium and three low (gbhackers.com). The most serious is CVE-2026-111497, nicknamed Node2Shell (aikido.dev), an out-of-bounds write in the bundled Brotli decoder that…