Node2Shell (CVE-2026-111497): The Brotli Flaw Behind the Node.js Security Release

Key Takeaways

• CVE-2026-111497 originates in Brotli and affects Node.js through its bundled decoder. Both statements are true, and the second is why patching Node alone may not be enough.
• Fixed Node.js versions: 22.23.4, 24.22.1, 26.12.1, all released 21 October 2026.
• Node.js 20.x and 25.x are end-of-life and will not be patched. Migrate rather than wait.
• Brotli is fixed in 1.0.10, 1.1.1 and 1.2.1. Python brotli in 1.2.1 and brotlicffi in 1.2.1.0. Bun 1.4.4 includes Brotli security fixes, though CVE-specific confirmation remains limited.
• Google, as the assigning authority, scores it 9.2 Critical on CVSS 4.0. The Node.js project rates it High. Both are correct for what they are scoring.
• Exposure requires your code to decompress attacker-supplied Brotli. Express 5 does this by default through express.json().
• It was not in CISA’s Known Exploited Vulnerabilities catalog as of 23 October 2026.
• Nine other CVEs shipped in the same Node.js release, including three further High-severity issues in DNS and TLS.

Prepared by the SearchEngineInfo editorial team. Details verified against the Node.js security advisory, the MITRE CVE record, the NVD entry, the GitHub advisory and the Brotli release notes. Checked 24 October 2026.

---

What is Node2Shell (CVE-2026-111497)?

Node2Shell is the informal name for CVE-2026-111497, an out-of-bounds write in the Brotli decompression library. It was published on 22 October 2026 and fixed in the Node.js security release of Wednesday, 21 October 2026.

The Node.js advisory describes the mechanism precisely, in two paragraphs:

“A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.”

“An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer.”

In plain terms: the decoder met input it should have rejected outright, treated it as merely incomplete, and kept writing into a buffer eight bytes long. The consequence, per Node.js, is that an attacker who supplies Brotli data your application decompresses “can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.”

The CVE record lists two weaknesses together, and the pairing tells the story: CWE-252, Unchecked Return Value, leading to CWE-787, Out-of-bounds Write. A return value that should have signalled a fatal format error was not checked, and the write went past the buffer.

---

Node2Shell originates in Brotli but also affects Node.js

Both halves of that heading matter. The defect is in Google’s Brotli decompression library. Node.js is genuinely vulnerable too, because it bundles that decoder and exposes it through node:zlib, which is why the Node.js project issued its own advisory and its own patched releases.

What the CVE record adds is where the defect lives, and that changes who else needs to act.

Node.js appears nowhere in that record, because the record describes the upstream library. The Node.js advisory documents the downstream impact separately. The same library sits underneath a great deal of other software, which is why the GitHub advisory is titled “Brotli: Out-of-bounds write in the Brotli decoder (‘Node2Shell’) also affects the PyPI Brotli package.”

---

Why the severity ratings disagree

You will see this called both High and Critical. Both are accurate, because they score different things.

The full CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Two parts of that are worth reading rather than skipping. PR:N and UI:N mean no privileges and no user interaction are required. AT:P means the attack requires certain conditions to be present, which is the scoring system acknowledging that this does not fire everywhere unconditionally.

---

What is affected

Node.js

End-of-life lines are the trap here. They received no fix in this release, and Node.js advises treating unsupported versions as affected whenever a security update ships. Upgrading the minor version on 20.x or 25.x achieves nothing, because there is no patched minor version to move to. Whether a given old build is exploitable depends on the bundled decoder version and whether attacker-controlled Brotli reaches it, but the remedy is the same either way: migrate to a supported line.

Brotli and everything else downstream

That last row deserves attention. Node.js carries its own bundled Brotli and received a cherry-picked fix. Software that links the system Brotli library instead depends on your distribution shipping a patched package, on its own schedule.

---

Are you actually exposed?

Having a vulnerable version installed is not the same as being reachable. The flaw needs attacker-controlled Brotli data to pass through a decoder in your process.

Check for these paths:

Express with express.json(), where body-parser 2.x is in use. That version’s documentation states the JSON parser “supports automatic inflation of gzip, br (brotli) and deflate encodings,” with inflate defaulting to true. Imperva’s testing covered Express 5.0.0 to 5.3.0 with body-parser 2.0.0 to 2.3.0 specifically. The parser still only handles requests matching its content-type and middleware configuration, so it does not decompress everything arriving at your server. Check which body-parser version your install resolves to rather than inferring from the Express major version.

Direct node:zlib use. Search your codebase for createBrotliDecompress, brotliDecompress and brotliDecompressSync.

Server-side fetch() to servers you do not control. Imperva’s tests covered Node’s built-in fetch() on consumed responses. Whether this is a live path for you depends on your runtime, whether the response actually arrives Brotli-encoded, and whether an attacker can influence what that upstream returns. A compromised or hostile upstream is the realistic scenario.

Anything accepting uploads or webhooks where a client sets the content encoding.

---

How to resolve it

1. Upgrade Node.js. Move to 22.23.4, 24.22.1 or 26.12.1. If you are on an end-of-life line, this is a migration rather than an upgrade, and it is now urgent for reasons beyond this one CVE.

2. Rebuild and redeploy container images. Patching the host does nothing for a container carrying its own Node binary.

3. Patch the other runtimes. Python brotli to 1.2.1 and brotlicffi to 1.2.1.0, both named directly in the GitHub advisory. For Bun, update to a release containing the relevant Brotli security fix and verify CVE-specific applicability against Bun’s own guidance, since 1.4.4’s notes list Brotli without naming this CVE. Check your distribution for a system Brotli update.

4. Audit your Brotli decode paths using the list in the previous section, so you know what your actual exposure was.

5. If you cannot patch immediately, these reduce exposure without replacing the fix:

• Reject Content-Encoding: br on inbound requests at your CDN, load balancer or reverse proxy.
• Set inflate: false in Express body parsing. Note that this rejects gzip as well, so it may break legitimate clients.
• Run Node.js as an unprivileged user, with as few secrets in its environment as the application can tolerate.

A WAF rule is a layer, not a substitute. Treat all of these as temporary.

Working out what you are running

These are inventory checks, not exploit tests. They tell you what versions are present and where Brotli decoding happens in your own code. In order, they report the Node.js version in the current environment, any direct Brotli decode calls in your source, which Express and body-parser versions actually resolve, the installed Python Brotli packages, and the Bun version where Bun is installed.

node --version
grep -RInE 'createBrotliDecompress|brotliDecompress' ./src
npm ls express body-parser
python -m pip show brotli brotlicffi
bun --version

A clean result here does not prove you are safe. Transitive dependencies, container images, other languages in the stack, and decode paths outside ./src can all still carry a vulnerable decoder. Run node --version inside the running container, not on the machine that built it.

---

Is it being exploited, and is it really RCE?

The honest answer is that the picture is contested, and anyone telling you otherwise is ahead of the evidence.

What is established. The memory corruption is real and the patch is real. Google scores the theoretical impact at 9.2. Node.js describes outcomes including crash, memory disclosure and remote code execution.

The strongest evidence so far. Imperva’s red team published an account on 22 October 2026 describing code execution through this flaw. Their report states that “code carried in that data had run inside the target process,” evidenced by a test application with no file-creation logic producing a marker file after receiving Brotli input. They used the official Node.js 24.22.0 Linux arm64 image in fresh containers, with no debugger or instrumented binary, and tested both Node’s built-in fetch() on consumed responses and Express 5.0.0 to 5.3.0 with body-parser 2.0.0 to 2.3.0 on request bodies.

Two caveats come from Imperva themselves. Execution “took multiple attempts in our setup” and “did not succeed on every attempt.” They tested those configurations, not every Node.js build or application. Critically, Node.js 24.22.1 rejected the same inputs and no marker file appeared, which is direct confirmation that the patch works.

What other public analysis shows. Less consistency. As summarized in Brandefense’s roundup of public proof-of-concept work, one analysis crashes unpatched Node.js without claiming code execution, another reports local code execution only under specific conditions including an unpatched system Brotli library and a predictable memory layout, and a third argues the realistic impact is denial of service. We have read that summary rather than each underlying analysis, so treat the characterization as second-hand. The takeaway holds either way: reliable exploitation from publicly available code is still disputed, even though Imperva’s controlled reproduction is not.

Exploitation in the wild. As of 23 October 2026, CVE-2026-111497 was not listed in CISA’s Known Exploited Vulnerabilities catalog.

None of this is a reason to delay patching. A reliable crash in a decoder reachable from the network is serious on its own, and the gap between “crash” and “code execution” has a habit of closing. It is a reason to describe the risk accurately when you escalate it internally.

---

The nine other CVEs in the same release

Node2Shell got the name and the attention. The 21 October release fixed ten issues, and three others are also rated High.

Two of those TLS issues allow certificate hostname validation to be bypassed. If your threat model includes machine-in-the-middle, they may matter to you more than the Brotli flaw does.

The Brotli fix was reported by OpenAI Codex Security, credited to Khai Tran and Sylvie Mayer, and fixed by Node.js maintainers Matteo Collina and Antoine du Hamel.

---

Keeping your site visible while you patch

If patching means downtime, the SEO handling is the same as for any emergency maintenance window, and we covered it in detail when PHP2Shell prompted the same question.

The short version: for a short maintenance window, return HTTP 503 with a Retry-After header rather than a 200 serving an error page, a 404, or a redirect to a holding page. A 503 tells Googlebot the outage is temporary. Keep robots.txt reachable while you do it, and restore normal responses promptly, because a 503 sustained over days can still affect crawling and indexing. It buys you a window, not indefinite cover.

---

Limits of this article

This is a developing situation. Everything here reflects the position on 24 October 2026, three days after the fix shipped. Exploitation status in particular can change quickly.

We have not independently tested exploitability. The claims about what proof-of-concept code does are reported from published analyses, and those analyses disagree with each other.

Distribution package status varies and moves. Check your own distribution’s security tracker rather than relying on a snapshot here.

Bun’s fix is listed but not explicitly tied to this CVE. Bun 1.4.4 shipped on 22 October 2026, and its release notes do list Brotli among the components receiving security fixes, alongside TLS, HTTP/1.1, HTTP/2, HTTP/3 and WebSocket. The notes do not name CVE-2026-111497. Treat 1.4.4 as the version to be on, and check Bun’s own security notes before recording it as a confirmed fix for this specific CVE.

NVD has the entry but has not finished analyzing it. As of 24 October 2026 the record is published with a status of “Awaiting Analysis,” carrying only Google’s own CVSS score. Version and remediation details here come from the MITRE CVE record, the Node.js advisory, the GitHub advisory and Brotli’s release notes, which are the upstream sources NVD will itself draw on.

---

Frequently Asked Questions

What is CVE-2026-111497?

An out-of-bounds write in the Brotli decompression library, published 22 October 2026 and nicknamed Node2Shell. A crafted Brotli stream can write past an eight-byte internal buffer, corrupting memory. Google scores it 9.2 Critical on CVSS 4.0. It reached public attention through Node.js, which bundles Brotli, but the CVE is recorded against Google’s Brotli library.

Does Node.js have vulnerabilities?

Yes, like any runtime. The 21 October 2026 release alone fixed ten, including four rated High. Node.js publishes them through its security release process, usually in batches, with advisories at nodejs.org. The practical response is to track the security blog, stay on a supported line, and treat end-of-life versions as permanently unpatched.

Which Node.js versions are affected by Node2Shell?

Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and 25.x are end-of-life, received no fix, and remain vulnerable. Upgrade the supported lines; migrate off the others.

What is CVE-2026-109618?

A different vulnerability. It is one of two critical remote code execution flaws in PHP, alongside CVE-2026-109619, known together as PHP2Shell. It has nothing to do with Brotli or Node.js beyond arriving in the same month. We covered it, and the HTTP 503 maintenance handling it prompted, in our PHP2Shell article.

Is PHP 7.4 vulnerable?

PHP 7.4 reached end of life in November 2022 and no longer receives upstream security updates, so it may contain unresolved vulnerabilities. Some Linux distributions backport selected fixes into their own packages, so the exact position depends on where your PHP came from. The appropriate remediation is migrating to a supported PHP release rather than relying on an unsupported one.

Is Node2Shell being exploited in the wild?

As of 23 October 2026, CVE-2026-111497 was not listed in CISA’s Known Exploited Vulnerabilities catalog. Read that for what it is: KEV records exploitation CISA has confirmed, so absence from it is not evidence that exploitation has never occurred. Separately, Imperva reported reproducing code execution in controlled testing on 22 October, taking several attempts, and confirmed the patched release rejected the same input. Public proof-of-concept code is less consistent. Patch regardless.

What are the top 5 CVE vulnerabilities?

There is no fixed list, because it depends on what you run. The useful version of this question is which vulnerabilities are known to be exploited, and the authoritative answer is CISA’s Known Exploited Vulnerabilities catalog rather than any ranking by severity score. A 9.8 in software you do not run matters less than a 6.5 in software exposed on your edge.

Can Node2Shell be exploited without authentication?

The CVSS vector says no privileges and no user interaction are required (PR:N/UI:N), so authentication is not a barrier in principle. What is required is that attacker-supplied Brotli data reaches a vulnerable decoder in your process. If an unauthenticated endpoint accepts compressed request bodies, that condition is met. The vector also carries AT:P, meaning further conditions must hold for an attack to succeed, which matches Imperva reporting that their reproduction took several attempts.

Does Express automatically decompress Brotli request bodies?

Where body-parser 2.x is in use, its JSON parser supports automatic inflation of gzip, Brotli and deflate, and the inflate option defaults to true. So you do not have to opt in. It still only processes requests matching its configured content type, so it is not decompressing everything that arrives. Check the resolved body-parser version with npm ls body-parser rather than inferring it from your Express major version.

If I patch Node.js, am I safe?

From Node’s bundled Brotli, yes. The same flaw affects Python’s brotli and brotlicffi packages, Bun, and anything linking a vulnerable system Brotli library. Patching Node fixes Node.

---

Sources and References

Primary sources

• Node.js, Wednesday, October 21, 2026 Security Releases
• MITRE CVE Record, CVE-2026-111497
• GitHub Advisory GHSA-9v8h-qqgm-4m35
• Google Brotli release notes, versions 1.0.10, 1.1.1 and 1.2.1
• Node.js release schedule and end-of-life dates
• CISA Known Exploited Vulnerabilities Catalog
• NVD entry for CVE-2026-111497, published 22 October 2026, Awaiting Analysis
• Bun v1.4.4 release notes, 22 October 2026

Original research

• Imperva, Node2Shell: From Brotli Data to Remote Code Execution, 22 October 2026

Secondary analysis

• Brandefense, Node2Shell: Node.js Brotli RCE
• Dynatrace security alert, Node2Shell

Related reading on this site

• PHP2Shell Vulnerability: HTTP 503 for Site Maintenance
• Technical SEO: Crawlability, Indexing and Site Health