Critical Remote Code Execution in Node.js 24.22.0 via Crafted Brotli Data (CVE‑2026‑111497)
What It Is – A flaw in the built‑in Brotli decoder of the official Node.js 24.22.0 Linux arm64 image allows an attacker to supply malicious Brotli‑compressed data that is decompressed and executed as native code. The vulnerability is tracked as CVE‑2026‑111497.
Exploitability – Researchers have released a proof‑of‑concept “Node2Shell” that runs arbitrary commands on an unmodified Node.js runtime. No debugger or custom build is required, indicating a high‑risk, readily exploitable condition. (Public CVSS score not yet published; the technical details suggest a score in the high range.)
Affected Products – Node.js 24.22.0 (official Linux arm64 image). Any application that uses the default Brotli decoder in this runtime version is potentially vulnerable.
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous monitoring of upstream component advisories and rapid patch deployment to satisfy the control objective of timely remediation.
- Evidence of Due Diligence – Maintaining an auditable trail of patch status and remediation actions supports compliance reviews across frameworks that reference vulnerability handling.
- Defensible Audit Trail – Documented remediation (e.g., upgrade to Node.js 24.22.1 or later) provides concrete evidence for auditors that the organization actively mitigates high‑severity code execution risks.
Recommended Actions
- Upgrade all Node.js runtimes to version 24.22.1 or later, which contains the fix for CVE‑2026‑111497.
- Integrate automated dependency scanning that flags vulnerable Node.js versions in CI/CD pipelines.
- Record the remediation steps in your control‑mapping repository to demonstrate compliance with vulnerability‑remediation objectives.
- Monitor public threat feeds for any exploitation attempts targeting the Brotli decoder.