Node2Shell: memory-corruption RCE in Brotli affects Node.js

A researcher published a proof of concept for CVE-2026-111497, a memory-corruption flaw in the Brotli 1.2.0 decoder affecting Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. Corrupted decoder state can redirect execution through a callback path to system().

• Affected: Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1
• DecodeBlockTypeAndLength returns BROTLI_FALSE (0), confused with BROTLI_DECODER_SUCCESS
• Small input fragments trigger out-of-bounds write; larger ones cause a CPU-spin DoS
• Overwriting callback state yields native command execution without JS primitives