Arkango/CVE-2026-111497

PoC

CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder OOB heap write. Independent research: exploit code, Docker labs, Express RCE gap analysis.

view exploit source poc_in_githubauthor Arkangopublished 2026-10-23catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-111497US	—	0.48% (41st)	Exploit	2026-10-22
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to co…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.