Node2Shell: Node.js Brotli flaw (CVE-2026-111497)
What happened?
On October 21, 2026, the Node.js project released fixes for a Brotli decompression flaw (CVE-2026-111497, "Node2Shell"). The flaw is an out-of-bounds write that can crash a process or allow remote code execution (RCE).
Okta's response
Security Patching Services: The change has been deployed across the production environments of both Okta and Auth0.
No Evidence of Exploitation: To date, Okta and Auth0 have observed no evidence of exploitation.
Do I need to do anything?
Customers using Auth0: We recommend updating the runtime version in your Auth0 tenant settings or in your Action configuration to Node 22, then deploying your changes. Customers already on Node 22 do not need to redeploy.
Customers using Auth0 SDKs with Node.js: We recommend downloading and installing the latest version.
Customers using the ad-ldap connector: We recommend downloading and installing the latest version.
Reference