Node2Shell puts Microsoft and Node.js on Brotli patch duty

Publisher excerpt From CSO Online

A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. Tracked as CVE-2026-111497, the high-severity flaw was first flagged in the Brotli decoder bundled with Node.js. The issue stems from an out-of-bounds write that can corrupt process memory, potentially leading to remote code execution (RCE), information disclosure, or denial of service (DoS). The Node.js project disclosed the vulnerability on October 21, 2026, alongside security updates for its 22.x, 24.x, and 26.x release lines. The exposure, however, extended beyond Node.js, forcing Microsoft to release out-of-band security updates for.NET on October 25 to address the same CVE in its Brotli decompression implementation. Separate research published by OpenSourceMalware identified the vulnerable decoder code in the Python packages Brotli and brotlicffi. Both packages have since received patched releases. The risk depends on whether an application uses an affected decoder to process attacker-controlled Brotli data. Remote code execution was demonstrated in a public GitHub proof-of-concept (PoC) lab and independently by cybersecurity firm Imperva, which gave the vulnerability its Node2Shell name. Services that decompress untrusted HTTP responses or request bodies are particularly exposed. Organizations must also account for runtimes and libraries bundled into containers and deployed applicati…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.