After PHP2Shell, here comes Node2Shell. If you run Node.js in production: same problem, same answer.
CVE-2026-111497: out-of-bounds write in the Brotli decoder bundled with Node.js, leading to remote code execution. CVSS 9.2. Public PoC available.
Patched versions: Node.js 22.23.4, 24.22.1, 26.12.1.
Node.js 25, 23, 20 and earlier: end of life, no fix. You need to upgrade.
The catch: the flaw is in the runtime, not in an npm package. A simple fetch() or Express 5 is enough to be exposed, without ever calling Brotli yourself.
Same Dynatrace dashboard, adapted: active Node.js processes by namespace and by host, each version classified (vulnerable, end of life, patched, unknown), images to rebuild, and a remediation curve down to zero.
Same limitations: runtime version only, and no visibility without OneAgent.
Here’s the link to download our dashboard for free from our GitHub : https://github.com/packet-perf/dt-pp-dashboard-Node2Shell