Node2Shell - Brotli Decoder Remote Code Execution CVE-2026-111497
- Severity
- EPSS Score
- EPSS Percentile
- Vulnerability description
- Not available
- Risk description
- Not available
- Recommendation
- Not available
- References
- https://patchtheplanet.org/brotlihttps://nodejs.org/en/blog/vulnerability/october-2026-security-releaseshttps://bun.com/blog/bun-v1.4.4https://nvd.nist.gov/vuln/detail/CVE-2026-111497https://www.cve.org/CVERecord?id=CVE-2026-111497https://github.com/envoyproxy/envoy/releaseshttps://github.com/envoyproxy/envoy/releases/tag/v1.36.12https://istio.io/latest/news/security/istio-security-2026-007/https://github.com/google/brotli/releases/tag/v1.2.1https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
- Codename
- node2shell
- Detectable with
- Network Scanner
- Scan engine
- Nuclei
- Cisa Kev
- No
- Exploitable with Sniper
- No
- CVE Published
- Oct 24, 2026
- Detection added at
- Software Type
- Not available
- Vendor
- nodejs
- Product
- node.js
Detect this vulnerability now!
Check your clients' targets (or your own) for this vulnerability and thousands more! Get proof for validation with our ethical hacking toolkit.