CVE

CVE-2026-111497

View on NVD ↗

Out-of-Bounds Write in Google Brotli Decoder

MITRE ATT&CK TTPs 3

T1055
Process Injection
Defense Evasion
 T1070.004
File Deletion
Defense Evasion
 T1203
Exploitation for Client Execution
Execution

Source Articles

Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Security researchers at Imperva demonstrated a remote code execution (RCE) exploit named 'Node2Shell' targeting a vulnerability in the Brotli decoder bundled with Node.js. The exploit leverages crafted Brotli-compressed data to trigger an out-of-bounds write, leading to code execution in unpatched versions of Node.js 22.x, 24.x, and 26.x. The vulnerability, tracked as CVE-2026-111497, was patched in Node.js 24.22.1 and other updated releases, with no known in-the-wild exploitation observed as of October 22, 2026.
hacker-news Oct 23, 2026