Overview
- Node.js issued patched releases for its supported lines on Wednesday that import an upstream Brotli fix and close CVE-2026-111497.
- Imperva researchers published a 'Node2Shell' proof-of-concept that ran attacker code on an official Node.js 24.22.0 Linux arm64 image by feeding the bundled Brotli decoder crafted compressed input.
- The bug is an out-of-bounds write in the bundled Brotli decoder that occurs when the decoder continues past an invalid block; the upstream patch makes the decoder stop earlier with a format error.
- There is no in-runtime workaround, so operators should upgrade affected binaries and any container images or single-file bundles that include Node.js because patched releases reject the crafted input.
- The October updates also fix other TLS and DNS issues and add a block for eight compromised eMudhra intermediate keys, so teams should treat this as a broader security update and audit deployed artifacts.