"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, disclosure of process memory, or remote code execution," the Node.js project said in an Oct. 21 advisory.
The project rated the flaw, tracked as CVE-2026 111497 and dubbed Node2Shell, as high severity and fixed it in versions 22.23.4, 24.22.1 and 26.12.1.
OpenAI's Codex Security team reported the bug. OpenAI said its AI agents found it while trying to break out of the company's own training sandbox.
KISA urged users of affected versions to update. Seoul-based security firm Theori said Monday it had reproduced the flaw. It said services can be exposed through the Node.js runtime itself even when developers' own code is sound.
The warning comes on the heels of PHP2Shell, two flaws in the PHP engine that cloud security firm Wiz said it uncovered with the help of AI models. PHP patched them Oct. 21 and scored them 9.2 out of 10 for severity.
The language powers about 71 percent of websites with a known server-side language, according to W3Techs.
Purported exploit code for PHP2Shell surfaced on GitHub a day before PHP's official disclosure and multiplied on the day of the announcement, according to AhnLab.
AJP Takeaways
- The Node.js project disclosed CVE-2026 111497 (Node2Shell) on Oct. 21, 2026, a high-severity flaw in Node.js' Brotli decompression code that can allow remote code execution.
- OpenAI's Codex Security team reported the bug, and OpenAI said its AI agents found it during internal sandbox-escape testing.
- The flaw follows PHP2Shell (CVE-2026 109618 and CVE-2026 109619), two PHP engine flaws patched on Oct. 21, 2026.
Copyright ⓒ Aju Press All rights reserved.