Node.js Brotli flaw allows crash or RCE (CVE-2026-111497)
Original title: Node2Shell: Node.js Brotli flaw (CVE-2026-111497)
Okta has patched production and is rolling the fix through Auth0, with no exploitation observed.
On October 21, 2026, the Node.js project released fixes for CVE-2026-111497, called Node2Shell, an out-of-bounds write in Brotli decompression. The flaw can crash a process or allow remote code execution. Okta says the change is deployed in its production environment and is still rolling out across Auth0 production. Auth0 customers are told to set the runtime to Node 22; SDK users should install the latest version.
Unconfirmed: Okta reports no exploitation evidence; broader exploitation status is not stated.
- The Node.js project released fixes on October 21, 2026.
- Okta reports no evidence of exploitation in Okta or Auth0.
- Auth0 customers should set the tenant or Action runtime to Node 22.
- Customers using Auth0 SDKs with Node.js should install the latest version.
Impact: process crash or remote code execution
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | — | — |
| Okta Auth0 | — | Node 22 |
- 1.Update the Auth0 tenant or Action runtime to Node 22 and deploy.
- 2.Install the latest Auth0 SDK version for Node.js.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×15 |
From the original article
1 min read at sec.okta.com
On October 21, 2026, the Node. js project released fixes for a Brotli decompression flaw (CVE-2026-111497, "Node2Shell"). Read on for Okta's response.
sec.okta.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.