Skip to content

All the news that matters, in plain English.

Latest
  1. UN alarmed as Israel seals West Bank after Hebron attack kills two soldiers
  2. Magnitude 6.9 earthquake strikes off Vanuatu; tsunami threat warning issued
  3. Pentagon designates Confucius Institutes a US national security threat
  4. Argentine judge drops fraud probe into Milei over $Libra crypto collapse
  5. UK government sets out £600m AI security funding package
  6. Iran has detailed plans to strike Gulf undersea cables if war resumes, Reuters reports
  7. PwC confirms cybersecurity incident involving employee learning records after Everest group claims 590GB theft
  8. Himanshu Bhau, most-wanted Haryana gangster, detained by FBI in Las Vegas

Technology

AI-found 'Node2Shell' flaw in Node.js Brotli decoder allows remote code execution

OpenAI Codex Security researchers found CVE-2026-111497, a critical out-of-bounds write in Node.js's bundled Brotli decoder that Imperva's Red Team dubbed 'Node2Shell' — a public exploit runs code on unpatched Node.js 24.22.0.

By James Calloway · · 1 min read

Editorial illustration of a cracked security shield over computer code, representing the Node.js Brotli vulnerability
Illustration: Flip News (AI-generated)

A critical remote code execution flaw in the Brotli decoder bundled with Node.js has a public exploit days after the fix shipped. Tracked as CVE-2026-111497 and dubbed “Node2Shell” by Imperva’s Red Team, it was found and reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer, per the Node.js October 21 security advisory.

The bug is an out-of-bounds write (CWE-787, CWE-252): a crafted stream declaring a single block type then switching blocks was not rejected, so decoding continued in an invalid state and wrote past an internal buffer. Attacker-supplied Brotli data an app decompresses can corrupt process memory, causing a crash, memory disclosure or remote code execution.

Imperva’s proof of concept ran attacker code on the official Node.js 24.22.0 Linux arm64 image, The Hacker News reported on October 23. Google, the CVE numbering authority, scored it 9.2 Critical under CVSS v4.0; Node.js rates it High.

The fix is out: Node.js 22.23.4, 24.22.1 and 26.12.1 (October 21), plus Brotli library updates 1.0.10, 1.1.1 and 1.2.1 and Bun 1.4.4. Node.js 20 and older get no fix; the upstream fix was committed in February 2026 but shipped without a release or advisory. Only services that decompress untrusted Brotli data are reachable — Express 5 and body-parser 2 are routes into the vulnerable decoder, not the flaw’s source. As of October 23, no exploitation in the wild has been reported and the CVE is not in the CISA known-exploited catalogue, but with working exploit code public, unpatched servers should update now.

Read next: more on this story at our cybersecurity hub.

More on this topic: all Technology stories

Get Flip News by email

This opens your email app — we add you manually. No account, no spam, no third parties.