Node2Shell and the Node.js October 2026 Security Release: What to Update
The Node.js security release of 21 October 2026 explained: what Node2Shell (CVE-2026-111497, a Brotli decoder bug) is, how it reaches apps through fetch(), zlib and Express 5, a plain-English table of all 10 CVEs, the fixed versions 26.12.1, 24.22.1 and 22.23.4, and how to update laptops, Docker images and hosting platforms.