Node2Shell (CVE-2026-111497): the Brotli RCE on VPS
CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…
Read more →