CISA adds Brotli CVE-2026-111497 (Node2Shell) to KEV as exploited
CISA added CVE-2026-111497, the Brotli decoder flaw behind Node2Shell, to the KEV catalog on Oct 27 with a Nov 10 federal deadline. Exploitation is now confirmed.
Stories tagged: #nodejs
Node.js patches Brotli decoder RCE (CVE-2026-111497); PoC public
Node.js fixed CVE-2026-111497, a high-severity out-of-bounds write in its bundled Brotli decoder that Imperva turned into an RCE PoC ('Node2Shell'). Lines 22.x, 24.x and 26.x are affected.
Node.js patches Brotli decoder RCE across all supported lines
Node.js shipped 22.23.4, 24.22.1 and 26.12.1 on Oct 21, fixing 10 flaws including CVE-2026-111497, a Brotli decoder out-of-bounds write rated High that allows remote code execution.
Node.js ships June 18 security release — 12 CVEs across v22, v24, v26
Node.js v22.23.0, v24.17.0 and v26.3.1 fix 12 CVEs including a TLS wildcard hostname bypass (CVE-2026-48618) and a WebCrypto integer overflow DoS (CVE-2026-48933).