🧰 Express 5 and body-parser 2.x

The items that name it 2

• Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
  writeup2026-10-29It is written here as Express 5 and body-parser 2.x (accept Brotli request bodies by default; Koa and NestJS inherit the behavior).

  accept Brotli request bodies by default; Koa and NestJS inherit the behavior

• Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)
  advisory2026-10-22It is written here as Express 5 and body-parser 2.x (decompress Brotli request bodies sent with Content-Encoding: br).

  decompress Brotli request bodies sent with Content-Encoding: br