Node2Shell (CVE-2026-111497): What It Is and How to Fix It
Node2Shell (CVE-2026-111497) is a critical out-of-bounds write in the Brotli decoder bundled with Node.js. Learn how it works, who is exposed through Express 5 and fetch(), how to detect vulnerable assets, and how to patch.
11 min read
