Node.js, October 2026: Node2Shell and nine other flaws, finding every Node you run
On 21 October 2026, the same day as the PHP2Shell fixes, the Node.js project published security releases for its three maintained lines: 22.23.4, 24.22.1 and 26.12.1. They fix ten flaws, one of which, CVE-2026-111497, was quickly nicknamed “Node2Shell”: an out-of-bounds write in the Brotli decoder Node bundles, remotely exploitable to run code. I’ve already devoted…