Wire · regulatory
Node2Shell: Node.js Brotli Flaw CVE-2026-111497 Can Allow Remote Code Execution ...
◆ Sectors
◆ Source
◆ Verified
Fusion42 · 23 October 2026 · Fusion42 review
A critical remote code execution flaw (CVE-2026-111497) affecting Node.js's bundled Brotli decoder was fixed in versions 22.23.4, 24.22.1, and 26.12.1. The vulnerability allows attackers to execute arbitrary code when Brotli-compressed data controlled by an attacker is decompressed, impacting specific middlewares and Node.js fetch operations.
This Wire brief sits within Fusion42's coverage of Enterprise Software and Cybersecurity.
◆ ◆ The Wire takeaway
You must upgrade your Node.js services now to avoid remote code execution risks from the Brotli decoder flaw. Delaying the patch leaves your service exposed to attackers using compressed data to run code on your servers.
◆ Coverage
1 source · 23 Oct 2026
◆ Related on Wire
◆ Topics