Introduction A serious security vulnerability known as Node2Shell (CVE-2026-111497) was disclosed on October 21, 2026, affecting the Node.js runtime. The vulnerability exists in the Brotli decompression implementation bundled with Node.js. Under certain conditions, an attacker can supply specially crafted compressed data that causes memory corruption in a Node.js application. Successful …