OpenAI researchers discovered a critical remote code execution vulnerability in the Brotli compression library, tracked as CVE-2026-111497 and nicknamed Node2Shell. The flaw, which carries a CVSS score of 9.2, stems from an out-of-bounds write issue that allows attackers to execute commands on target systems without authentication.
The vulnerability affects both client-side and server-side applications. Node.js released security patches in versions 22.23.4, 24.22.1, and 26.12.1 on October 21, 2026. These updates also addressed nine other security issues, including TLS hostname-check bypasses.
Other affected projects include Bun, which requires an update to version 1.4.4 or later, as well as Envoy and various Python packages on PyPI. While no widespread exploitation was reported as of October 23, 2026, proof-of-concept code has already surfaced.
The delay between the initial fix in the Brotli source code in February 2026 and the formal disclosure in October 2026 highlights challenges in managing bundled dependencies in open-source software. Engineering teams are advised to identify and update all instances of the library within their stacks.
