Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.
Ok, so Qlik Sense Enterprise on Windows runs on Node.js 24.14.1. I have the following questions:
1. Does the specific implementation of a vulnerable Node.js version in Qlik Sense Enterprise on Windows implicate a threat to installations of Qlik Sense?
2. Are there any migitating actions that can be undertaken by administrators to continue operating safely until Qlik Sense/Node.js is patched?
3. Is there a patch coming? If so, when is this expected to be made available?
@Jamie_Gregory and @Sonja_Bauernfeind sorry for tagging you directly, but could you shed any light on this? It would be great to know if this is under investigation or perhaps not an issue at all.
I chatted with Qlik Support here and got information that Qlik Sense Enterprise on Windows doesnt use brotli and is therefore not affected by CVE-2026-111497. Very relived to get this infomration, althogh it would be nice if Qlik put out some information reagrding this on Community.
