CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE
IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attacker-controlled Brotli data. Successful exploitation may result in process crashes, disclosure of process memory, or remote code execution (RCE). Imperva reported demonstrating code execution in fresh containers running the official Node.js 24.22.0 Linux arm64 image, with multiple
- Vendor
- Google, Node.js
- Product
- Node.js
- EPSS
- 0.83 (p100)
- Exposure class
- Developer platform
Why it ranks 38 (Notable)
- EPSS 0.88 (high probability of exploitation)
- Product class: developer platform
- Covered by 19 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Zscaler ThreatLabz (zscaler.com)
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.