At a glance

Item Detail

CVE ID CVE-2026-111497 (nicknamed Node2Shell )

Vulnerability class CWE-787 (out-of-bounds write); root cause is CWE-252 (unchecked return value)

Severity High (per Node.js's official classification — though "remote blind RCE" is not established by any public PoC)

Affected component Google Brotli decoder, c/dec/decode.c (Brotli 1.0.3–1.0.9 / 1.1.0 / 1.2.0)

Affected Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1 (any distro Node that dynamically links system Brotli); Python brotli / brotlicffi share the same bug

Fixed in Brotli 1.0.10 / 1.1.1 / 1.2.1, Node.js 22.23.4 / 24.22.1 / 26.12.1 (2026-10-21)

Reported by OpenAI Codex Security (Khai Tran, Sylvie Mayer); fixed by Matteo Collina and Antoine du Hamel

Public PoC dimasma0305/CVE-2026-111497-POC ; independent reproduction and struct-offset analysis in TheFool-TAROT/CVE-2026-111497-brotli-pwn

Brotli is the format behind Content-Encoding: br , so this decoder runs whenever Node.js decompresses Brotli data — directly…