Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.
Ok, so Qlik Sense Enterprise on Windows runs on Node.js 24.14.1. I have the following questions:
1. Does the specific implementation of a vulnerable Node.js version in Qlik Sense Enterprise on Windows implicate a threat to installations of Qlik Sense?
2. Are there any migitating actions that can be undertaken by administrators to continue operating safely until Qlik Sense/Node.js is patched?
3. Is there a patch coming? If so, when is this expected to be made available?
