Security Advisory: Status of CVE-2026-111497 (“Node2Shell”) regarding the Aridhia Digital Research Environment (DRE)

Published: 30 October 2026

The Aridhia DRE platform, the Aridhia public website, and the Aridhia Knowledge Base are not affected by CVE-2026-111497.

Impact Summary

  • Status: Not Affected (DRE platform, public website, Knowledge Base)
  • Affected Component: Node.js 22.x, 24.x and 26.x before the 21 October 2026 security releases. The flaw is an out-of-bounds write in the bundled Brotli decompression library (node:zlib / fetch()).
  • Action Required: No action is needed for the DRE platform. Workspace users who have installed Node.js on workspace virtual machines should upgrade to a fixed version (22.23.4, 24.22.1, 26.12.1 or later).

Technical Rationale

The DRE platform services do not use an affected Node.js release line; Node.js is not used to process untrusted Brotli-compressed content on internet-facing services.

Workspace virtual machines are provisioned and configured by users, including software installed by users on these machines. If VMs run an outdated version, upgrading to a fixed version is recommended.

Verification and Continuous Monitoring

Aridhia’s automated vulnerability scanning and dependency monitoring tools are tracking CVE-2026-111497 and related Node.js advisories. We will update this bulletin if our assessment changes or new information becomes available.

Contact

Enterprise security teams who need a formal statement or security attestation, or who have questions about this advisory, can contact info@aridhia.com. 

Back to top