The Node2Shell vulnerability is a high-severity flaw in Node.js, tracked as CVE-2026-111497. It lives in the Brotli decompression code bundled with the runtime. A malformed Brotli payload can crash a process, leak memory, or in some setups trigger remote code execution. Node.js shipped a fix on October 21, 2026. Any service you run that decompresses untrusted data is exposed. You need to know how the bug works and whether you already patched it.
What Is the Node2Shell Vulnerability
Security researchers at Imperva named Node2Shell for CVE-2026-111497. The flaw lies in the Brotli decoder that Node.js vendors include in its source tree. Google assigned the issue a CVSS 4.0 score of 9.2 as the CVE Numbering Authority. Node.js itself rates the runtime impact as high rather than critical.
The root cause is an out-of-bounds write triggered by an unchecked return value during decompression. Feed the decoder a crafted, invalid Brotli stream, and it can write past the end of its buffer. That corruption can crash the process outright. Under the right conditions, it can let an attacker control what gets written, and where.
This is not a flaw in an npm package you installed. It sits inside the Node.js binary itself, in the bundled copy of Google’s Brotli library. A separate npm package also named “brotli” exists, but it has nothing to do with this bug.
Why CVE-2026-111497 Matters for Node.js Developers
Brotli compression touches more of a typical Node.js app than most developers realize. The built-in fetch() function decompresses Brotli responses automatically. Express 5 paired with body-parser 2.x inflates compressed request bodies the same way. Neither case asks for explicit opt-in, so the vulnerable code path runs quietly in the background.
Skipping the patch is expensive precisely because of that reach. Security spending on this kind of runtime hardening keeps climbing. The global DevSecOps market is projected to reach $45.93 billion as teams fold security scanning deeper into their pipelines. A single unpatched runtime dependency can undo that investment in one bad request.
Every supported Node.js release line carried the flaw before the October 2026 patch. Node.js 22.x, 24.x, and 26.x all needed updates. End-of-life lines, including 25.x, 23.x, and 20.x, received no official fix. Teams still running those versions carry the risk indefinitely unless they migrate or buy extended support.
How the Brotli Decoder Flaw Actually Works
Brotli is a general-purpose compression format that Node.js bundles for both inbound and outbound data. Affected Brotli versions range from 1.0.3 through 1.0.9, plus 1.1.0 and 1.2.0. The upstream project fixed the bug in Brotli 1.0.10, 1.1.1, and 1.2.1. Node.js cherry-picked that patch into its own bundled copy.
An attacker only needs a crafted, malformed compressed stream to trigger the bug. The decoder fails to validate a return value correctly, then writes beyond its allocated buffer. Node.js’s own security advisory rates this a high-severity issue. Depending on the target process, it can cause denial of service, memory disclosure, or code execution.
Researchers demonstrated real impact, beyond theory. Imperva’s Red Team achieved code execution against an unmodified Node.js 24.22.0 image on Linux arm64. However, the exploit didn’t succeed on every attempt, and other architectures received less testing. Node.js 24.22.1 rejected the same malicious input outright.
Real Attack Paths: Fetch, Express, and Direct Zlib Calls
Three paths let attacker-controlled Brotli data reach the vulnerable decoder. The first runs through outbound requests: calling fetch() against a malicious or compromised server triggers automatic decompression of its response. Webhooks and user-supplied URLs are common entry points here, since the app fetches content it never fully controls.
The second path runs through inbound requests. Express 5 combined with body-parser 2.x decompresses request bodies sent with a Content-Encoding: br header. A bare Node.js HTTP server without that middleware does not decode Brotli on its own, which narrows the exposure.
The third path is direct and intentional: passing untrusted input straight into node:zlib functions like brotliDecompress or createBrotliDecompress. Any service that accepts user-uploaded compressed files or archives should treat these functions as a direct line to attacker input. Code review for this bug should start wherever compressed data enters an application. Don’t stop at the obvious API boundary.
How to Patch and Mitigate Node2Shell Today
Patching starts with a Node.js upgrade. Pick 22.23.4 on the 22.x line, 24.22.1 on 24.x, or 26.12.1 on 26.x. Bun users need 1.4.4 or newer, since Bun bundles its own vulnerable Brotli copy too.
An upgrade alone will not help if old container images stay in production. Rebuild every image that embeds the Node.js runtime, then redeploy and restart the affected processes. This matters for teams running workloads across multiple cloud providers. Different cloud computing models handle image rebuilds and rollouts differently.
Teams stuck on end-of-life Node.js versions have fewer good options. Migrating to a supported line is the most durable fix, though it takes more planning. As a stopgap, reject requests carrying a Content-Encoding: br header at a reverse proxy or load balancer. That blocks only the inbound path, not outbound fetch calls hitting a hostile server.
Key Takeaways
- Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled inside Node.js.
- Google scored it CVSS 9.2; Node.js rates its own runtime impact as high.
- Fixed versions are Node.js 22.23.4, 24.22.1, and 26.12.1, released October 21, 2026.
- Fetch calls, Express 5 with body-parser 2.x, and direct zlib Brotli calls all expose the bug.
- No confirmed in-the-wild exploitation existed as of late October 2026, but a working proof of concept does.
Frequently Asked Questions About Node2Shell
What Is CVE-2026-111497?
CVE-2026-111497 is the official identifier for Node2Shell. It names an out-of-bounds write in the Brotli decompression code that Node.js bundles with its runtime.
Which Node.js Versions Does Node2Shell Affect?
All supported versions were vulnerable before October 21, 2026. Patches landed in Node.js 22.23.4, 24.22.1, and 26.12.1. End-of-life lines like 25.x, 23.x, and 20.x never received an official fix.
Can Node2Shell Lead to Remote Code Execution?
Yes, under the right conditions. Imperva’s Red Team showed code execution on an unpatched Node.js 24.22.0 image. That exploit was not reliable on every attempt, though.
Does Updating the npm Brotli Package Fix This?
No. The vulnerable code lives inside the Node.js runtime binary itself, not in the separately maintained npm package named “brotli.”
Is Node2Shell Being Exploited in the Wild?
As of late October 2026, no confirmed in-the-wild exploitation had surfaced. The flaw was also not listed in CISA’s Known Exploited Vulnerabilities catalog.
What Should I Do if I Run an End-of-Life Node.js Version?
Plan a migration to a supported release line as soon as possible. Until then, block inbound Brotli-encoded requests at a proxy as a temporary stopgap.
Final Thoughts
Node2Shell reminds us that runtime dependencies deserve the same scrutiny as application code. A single bundled library, quietly doing its job on every compressed request, became a path to crashes and code execution. Patch to 22.23.4, 24.22.1, or 26.12.1 now if you have not already. Then check your container images, your CI pipelines, and anything still running an end-of-life version of Node.js.
Photo by Favour Usifo: Unsplash
