On October 21, 2026, Node.js released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability, named Node2Shell, allows an ...