We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
About this summary. This is a short excerpt from the description that Datadog Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/
Source attribution: headline and facts are from Datadog Security Labs (securitylabs.datadoghq.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node.js, Bun, Envoy…
2nd November – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 2nd November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Binance, a global…
CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other…
AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497
Number: AL26-027 Date: October 28, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently…
U.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalog. The…
SVD-2026-1015: Vulnerabilities in Node.js (CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069) on Splunk Products - October 2026
Splunk investigated and determined which products may be affected by four high-impact vulnerabilities in supported Node.js release lines.