Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data

CVE-2026-111497 in bundled Brotli decompression allows RCE on Node.js 24.22.0 and all supported versions via malicious decompressed data. Proof-of-concept confirmed.