Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE

The Brotli decoder bundled with Node.js contains an out-of-bounds write vulnerability. According to the source, the vulnerability affects applications that decode attacker-controlled Brotli data. As of October 23, no confirmed in-the-wild exploitation had been reported and the vulnerability had not been added to CISA’s KEV catalog, but public PoC code was available. Reported impacts include service crashes, memory disclosure, and code execution under limited conditions.