Vendors and CVEs › CVEs › CVE-2026-111497
CVE-2026-111497: what it is, who is affected and what to do
On 21 October 2026 the Node.js project fixed a flaw in its Brotli decoder, called Node2Shell (CVE-2026-111497). A remote attacker could corrupt memory and possibly run code. Siemens reports which of its software products are affected.
- Known exploited. Yes, on CISA’s list of exploited flaws.
- Records. CVE-2026-111497 on the National Vulnerability Database · CISA’s known exploited catalog
The story
Critical Known exploited
Siemens lists products affected by Node.js Brotli flaw 'Node2Shell'
On 21 October 2026 the Node.js project fixed a flaw in its Brotli decoder, called Node2Shell (CVE-2026-111497). A remote attacker could corrupt memory and possibly run code.