Unpacking "Node2Shell" (CVE-2026-111497): The Critical Node.js Brotli Vulnerability and How to Protect Your Apps
Unpacking "Node2Shell" (CVE-2026-111497) If you manage Node.js infrastructure, you likely saw the security advisory drop. Node.js rolled out urgent patches across its active release lines to fix 10 vulnerabilities , the most severe of which is a high-severity flaw in the bundled Brotli decoder. Quickly dubbed "Node2Shell" and tracked as CVE-2026-111497 , this out-of-bounds write flaw has security teams scrambling. Unlike standard vulnerabilities found via npm audit in third-party packages, this lives right inside the Node.js runtime core. In this post, we’ll break down what the vulnerability is, who is actually exposed, how to patch it, and how you can implement an emergency AWS WAF rule to stop malicious exploit payloads at the network edge if you can't upgrade immediately. 1. What is the Vulnerability? (CVE-2026-111497) The core issue stems from Google’s Brotli compression library , a copy of which is bundled directly into the Node.js zlib libra...