OpenAI identified a remote code execution vulnerability in the Brotli decoder, tracked as CVE-2026-111497 and nicknamed Node2Shell. The attack relies on an out-of-bounds write triggered by malicious compressed data and can target both clients and servers without authentication. The flaw has a critical CVSS score of 9.2 and affects Node.js, Bun, Envoy, and several Python packages. Node.js released patched versions 22.23.4, 24.22.1, and 26.12.1 on October 21, 2026, while Bun users must update to version 1.4.4 or later. Although no widespread exploitation had been observed as of October 23, 2026, proof-of-concept code has emerged, and researchers have successfully exploited the vulnerability against affected Node.js builds.
Source: Read the original article
