Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Node2Shell documents CVE-2026-111497, an out-of-bounds write in the Google Brotli C decoder that affects Node.js and many runtimes and proxies built on it, including Python, Bun, Java brotli4j, .NET, Envoy, and Istio.