Node.js patches Brotli decoder RCE (CVE-2026-111497); PoC public
Node.js fixed CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that Imperva turned into an RCE PoC ('Node2Shell'). Lines 22.x, 24.x and 26.x are affected.