Oh man, light a candle for #infosec, #sysop, and #ops, cause if you thought the #php #cve was fun, wait till you hear about CVE-2026-111497, AKA as Node2Shell, HTTP2Shell, and Broccoli2Shell, a high-severity out-of-bounds write vulnerability in the Brotli decoder that can permit remote code execution (#RCE). The bug allows data to overwrite memory buffers when a process decompresses untrusted Brotli streams. It was surfaced by #OpenAI’s red team.
Fixed versions were released this weekend, but systems using system-linked Brotli libraries (e.g., Debian, Alpine) must verify their distribution-specific package updates, as the Node.js binary release does not patch those external dependencies.
While researchers from Imperva demonstrated successful code execution on a specific Node.js 24.22.0 Linux arm64 build, no widespread exploitation in the wild has been reported as of October 25, 2026..
https://nvd.nist.gov/vuln/detail/cve-2026-111497