A severe security issue recently uncovered in Node.js has alarmed developers and cybersecurity specialists globally. Dubbed CVE-2026-111497, this vulnerability has a CVSS v3.1 score of 9.8 out of 10, as per Singapore’s Cyber Security Agency, and has the potential to enable attackers to execute harmful code on vulnerable platforms.
The Node.js team made this news public on October 21, 2026, announcing security updates for this flaw and nine others.
Who Discovered the Vulnerability?
Khai Tran and Sylvie Mayer from OpenAI Codex Security have reported the vulnerability by noticing the memory corruption in Brotli decompression component found in Node.js.
As per the official Node.js security advisory, both the researchers have been credited for reporting the vulnerability, but formal details about the research method applied by them have not been disclosed.
After the responsible disclosure of the flaw, the Node.js maintainers Matteo Collina (mcollina) and Antoine du Hamel (aduh95) have been credited for fixing the flaw.
How Does the Vulnerability Work?
The vulnerability originates in Brotli, a compression technology commonly used to reduce data sizes in web applications.
Under normal conditions, Brotli decompresses incoming data into its original format. However, researchers identified a flaw in how its decoder handles malformed compressed input.
During decoding, an invalid block transition could incorrectly be treated as a request for additional input rather than a permanent error. Consequently, the decoder could continue writing data into an internal eight-byte buffer, exceeding its allocated memory.
This out-of-bounds write can corrupt application memory, potentially resulting in server crashes, sensitive information disclosure, or remote code execution.
Attackers could exploit this weakness when vulnerable Node.js applications decompress attacker-controlled Brotli data, including through certain node:zlib operations or automatically decompressed HTTP responses.
Scientists Prove Node2Shell Exploit
On October 23, 2026, scientists from Imperva conducted a demonstration of a proof-of-concept exploit known as Node2Shell.
In doing this, they achieved the execution of code on a standard release of Node.js 24.22.0 for Linux ARM64 with specifically crafted inputs in the Brotli format.
This particular attack was not effective on all types of computers. It must be noted, that the new version, Node.js 24.22.1, was able to block the dangerous inputs.
Even though the exploit has been proved successful for experimental purposes, it has not been confirmed that it has been used in the modern world.
Compromised Node.js Versions and Solving Data Breaches
Due to the vulnerability in Node.js software, many developers have updated their codes and introduced security patches to prevent further software failure. Organizations are requested to upgrade Node.js version to 22.23.4 that is still being used, while those using Node.js versions 24.x and 26.x should switch to 24.22.1 and 26.12.1, respectively. Security experts recommend the immediate use of those updates to minimize any risks of attack. Organizations should also analyze their software for trustworthy data compression, analyze their code and installation of containers, and ensure that outdated Node.js is replaced by new versions. Security institutions such as Singapore Cyber Security Agency and Malaysia MyCERT have already issued their warning and urged businesses to install the updates. The case signifies the importance of a vulnerability in an application widely used by different software and the necessity to solve its problems in order to minimize the possibility of exploits.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
