The Node.js project issued emergency security releases addressing a critical remote code execution flaw tracked as CVE-2026-111497 (dubbed “Node2Shell”, CVSS 9.2). Located in the bundled Google Brotli C decompression library (c/dec/decode.c, versions 1.0.3 through 1.2.0), the vulnerability is an out-of-bounds write flaw (CWE-787). Malformed Brotli-compressed byte streams exploit improper state handling and invalid block-switching logic within the native decoder, corrupting adjacent heap structures during memory decompression before userland JavaScript execution begins.

Exploitation pathways expose any server-side runtime that ingests untrusted compressed data, including Express 5 request-body middleware configured for Content-Encoding: br and client HTTP requests invoking native fetch() or zlib against untrusted endpoints. Independent security researchers confirmed pre-authentication remote code execution against unhardened, official Node.js container images. The Node.js team patched the flaw across active release branches in versions 22.23.4, 24.22.1, and 26.12.1; end-of-life lines (including 20.x) remain vulnerable without vendor backports.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Native runtime memory corruption triggered during payload decompression executes entirely in C memory space before web application firewalls or application-level middleware can inspect or sanitize the request body, yielding direct arbitrary code execution.
• Bullet 2 — Strategic & Defender Imperative: Operations teams must rebuild container base images and upgrade Node.js runtimes immediately; where patching cannot be executed immediately, defenders should configure reverse proxies or edge WAFs to reject or strip incoming Content-Encoding: br headers.