WA Cyber Security Unit warns of a critical Node.js flaw in the Brotli decoder

The Western Australian Government’s Cyber Security Unit has published an advisory about a critical vulnerability in the Brotli decoder used by Node.js, a widely used platform for running websites and web applications. The flaw is tracked as CVE-2026-111497, and the advisory refers to it as “nodejs2shell”.

The WA advisory says successful exploitation can expose applications to unauthenticated remote code execution, memory disclosure and denial of service. It rates the flaw Critical, with a CVSS score of 9.2. Node.js’s own security release, published on 21 October 2026, rates the issue High. It says malformed compressed data can write past the end of an internal buffer.

Who it affects

According to the WA advisory, affected products are Google Brotli versions 1.0.3 to 1.2.0, and the Node.js 26.x, 24.x and 22.x release lines. This mainly matters to businesses whose websites or online services are built on Node.js, and to the developers and hosting providers who run them.

What the sources say

• The WA advisory says administrators should apply the vendor’s fixes to affected systems.
• Node.js lists the fixed versions as 26.12.1, 24.22.1 and 22.23.4. It notes that end-of-life versions are always affected when a security release occurs.

The WA advisory says it had no reports of exploitation on WA Government networks at the time of writing.

Our supplier security guide covers questions a business can ask the IT and service providers it relies on, and our Essential Eight explained guide covers patching applications.