Node2Shell Explained: Watch a Memory Bug Fail in the Browser

One click, eight writes, and a native memory error. In this hands-on local lab, we send real Brotli requests to Node.js, trigger an instrumented C++ buffer overflow, inspect AddressSanitizer output, and repeat the same input against corrected code. The C++ worker is a teaching model, not an implementation of CVE-2026-111497 and not a demonstration of remote code execution. Browser results come from actual local HTTP requests and process output. Narration is AI-generated using the creator-selected voice profile. CHAPTERS 00:00 One click. A native memory error. 00:18 The Node2Shell story 00:44 JavaScript can reach native code 01:07 First, a legitimate request 01:27 Malformed input should stop decoding 01:49 Inside the teaching model 02:11 The decision that changes everything 02:34 Trigger the unsafe worker 02:58 Read the evidence, not just the color 03:20 Why the browser still works 03:42 Correct the error path 04:05 Repeat with the corrected worker 04:24 Same bytes. Two outcomes. 04:45 Keep the evidence 05:07 What developers should update 05:29 The takeaway SOURCES https://nodejs.org/en/blog/vulnerabil... https://nodejs.org/en/blog/release/v2... Facts checked October 26, 2026. Fixed releases shown are the first fixes in the respective branches; use a supported, up-to-date runtime. #nodejs #cplusplus #Node2Shell #Brotli #memory