Node2Shell: Node.js Brotli flaw (CVE-2026-111497)
What happened?
On October 21, 2026, the Node.js project released fixes for a Brotli decompression flaw (CVE-2026-111497, "Node2Shell"). The flaw is an out-of-bounds write that can crash a process or allow remote code execution (RCE).
Okta's response
Security Patching Services: The change has been deployed across Okta’s production environment. The change is continuing to roll out across Auth0 production.
No Evidence of Exploitation: To date, Okta and Auth0 have observed no evidence of exploitation.
Do I need to do anything?
Customers using Auth0: We recommend updating the runtime version in your Auth0 tenant settings or in your Action configuration to Node 22, then deploying your changes.
Customers using Auth0 SDKs with Node.js: We recommend downloading and installing the latest version.
Customers using the ad-ldap connector: We recommend downloading and installing the latest version.
Reference