cve-research
CVE-2026-111497: Node.js Brotli Decoder RCE — Node2Shell Explained
A malformed Brotli stream can corrupt memory in any Node.js process that decompresses attacker-controlled data — including through fetch(). CVE-2026-111497 scores 9.2 on CVSS 4.0 and affects every supported Node.js release line. Here's what you need to know.