---
id: 10307
title: "Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)"
cve: CVE-2026-111497
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"
published_at: "2026-10-22T00:00:00Z"
tags: ["rce", "aikido", "security", "nodejs", "brotli", "node2shell"]
phying_url: "https://phying.com/item/10307"
lang: en
---

# Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

## Summary

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.

## Intelligence Metadata

- **Sources:** aikido.dev
- **CVE:** CVE-2026-111497
- **Published:** 2026-10-22T00:00:00Z
- **Original:** https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
- **Phying News:** https://phying.com/item/10307