Node2Shell: npm audit can't see the Node.js Brotli RCE
CVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.
Tagged
Tagged
CVE-2026-111497 lives in the Node.js runtime, not your dependencies. Where Express 5 and fetch() expose you, and a short audit plus stopgap before you rebuild.