Affected Akamai ExAR customers have already received a detailed mapping of vulnerable assets with actionable mitigation steps.

Key takeaways

On October 21, 2026, Node.js released security updates that fix CVE-2026-111497 , an out-of-bounds write in the Brotli decoder bundled with Node.js.

The vulnerability, named Node2Shell, allows an attacker who can supply malformed Brotli-compressed data to corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution (RCE).

The CVE was assigned a CVSS score of 9.2 (critical) .…