Security researchers have demonstrated a remote code execution vulnerability affecting official Node.js builds through malicious Brotli compression data. The flaw, designated as CVE-2026-111497 and dubbed Node2Shell, allows attackers to run arbitrary code on standard images like Node.js 24.22.0 for Linux arm64 by exploiting the bundled decoder. Administrators must apply available patches immediately to mitigate container and server compromise risks.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →