Node2Shell Explained: The Node.js Brotli Bug (CVE-2026-111497) and How to Patch It
A Brotli decoder bug in Node.js can lead to remote code execution, and your app may decode Brotli without you knowing. Here’s who’s exposed and how to patch every Node you run.
16 min read