October 23, 2026
- Node.js Brotli bug CVE-2026-111497 is being reproduced as pre-auth RCE. Node.js patched 10 flaws across the 22.x, 24.x and 26.x lines on October 21, the worst being memory corruption in the bundled Brotli decompression code. Florian Roth warns the surface is wider than it looks — common Express 5 middleware configurations can expose the vulnerable decoder without a developer touching Brotli — and researchers claiming a working pre-auth chain are already calling it "Node2Shell". The Hacker News · Vulnerabilities & Exploits
in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them