Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

Node.js fixes 10 flaws, including a Brotli decoder bug that may allow code execution when apps decompress attacker-controlled ...

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 flaws, including Brotli RCE bug CVE-2026-111497 and three TLS hostname bugs.

Node.js has shipped security updates to fix a high-severity vulnerability that could let an attacker run arbitrary code on a ...

A security update released October 21 fixes ten vulnerabilities across Node.js 26.x, 24.x, and 22.x, including an out-of-bounds write in the Brotli decompression library.

IntroductionImperva researchers have demonstrated that crafted Brotli data can be used to execute attacker code in ...

Node.js 26.12.1, 24.22.1 and 22.23.4 fix TLS verification bypasses, a Brotli decoder bug and a repeated-random-value issue in ...

While the world reels from websites being taken down before critical PHP patches were released, Node.js is urging overnight ...