Critical 9.2
CVE-2026-111497
Imperva Demonstrates Node2Shell PoC Exploit for Node.js Vulnerability CVE-2026-111497
Vendor / product: Node.js
Event date: 2026-10-21
Public PoC: Yes
First tracked by RiskWire: 2026-10-24
Sources & citations (9)
- Node2Shell: PoC exploit for critical vulnerability in Node.js secnews.gr · 2026-10-23
- Node.js patched a code-execution Brotli bug October 21 dev.to · 2026-10-23
- Node.js·Bun 브로틀리 결함…'노드2셸' RCE 위험 news.jkn.co.kr · 2026-10-23
- New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data cybersecuritynews.com · 2026-10-23
- Node2Shell (CVE-2026-111497): The Node.js Brotli RCE You Need to Patch Today dev.to · 2026-10-23
- Node.js patches Node2shell flaw with CVE-2026-111497 fix el-balad.com · 2026-10-23
- Node2Shell: Node.js Brotli vulnerability allows remote code execution malwaretips.com · 2026-10-23
- Bug in Node.js maakte op afstand uitvoeren van code mogelijk tweakers.net · 2026-10-23
- High-risk RCE vulnerability confirmed in Node.js; emergency patch released news.jkn.co.kr · 2026-10-23
References
See CVE-2026-111497 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →