Skip to content
securitytabs

Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder

Datadog Security LabsVulnerabilities

We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.

Summary from Datadog Security Labs.

Read the full article at Datadog Security Labs
Full story2 outlets are covering this story. Read the summary and every outlet's coverage SecurityTabs reportupdated just nowBrotli Decompression Flaw in Node.js and Other Software Under Attack

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Vulnerabilities in this story

Severity and exploitation facts from NVD, FIRST, and CISA.

Related coverage

Other sources covering the same vulnerabilities or event.

More in Vulnerabilities