A critical flaw in Google’s Brotli decoder, dubbed Node2Shell, may let remote attackers execute code on servers that decompress untrusted Brotli data, including every Node.js app. Patched Node.js releases are available, and we are already detecting exposed targets.
What's the vulnerability?
CVE-2026-111497, also tracked as Node2Shell (or HTTP2Shell, Brotli2Shell), is an out-of-bounds write in the Brotli decoder (c/dec/decode.c). Google rates it CVSS v4.0 9.2. Node.js rates it High and says it allows for remote code execution.
Node.js and Bun ship their own copy of Brotli, so the flaw is in the runtime binary, and not in an npm package. An app is exposed when attacker data reaches the decoder:
- Request bodies sent with Content-Encoding: br. Express 5 and body-parser 2.x decode them by default in json(), urlencoded(), text() and raw(). So do the Koa body parsers (koa-bodyparser, @koa/bodyparser, koa-body, co-body) and @fastify/compress with request decompression.
- Responses read by the built-in fetch(), which asks HTTPS servers for Brotli by default. Code that fetches user-supplied URLs or calls a compromised service is exposed.
- Direct calls to zlib.brotliDecompress, brotliDecompressSync or createBrotliDecompress on untrusted data.
Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, through both Express 5 request bodies and fetch() responses. As of 25 October, no exploitation in the wild had been reported and the CVE was not in CISA KEV.
The upstream fix sat in the google/brotli repository since 27 February 2026, with no release or advisory until 21 October.
The flaw was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security.
Which versions are affected?
- Google Brotli 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1.
- Node.js 22, 24 and 26 before 22.23.4, 24.22.1 and 26.12.1.
- Node.js 20 and every other end-of-life line. They will not receive a fix.
- Bun before 1.4.4.
- Bindings that bundle the decoder: Python brotli (fixed in 1.2.1) and brotlicffi (1.2.1.0), Java brotli4j (1.24.0) and the Ruby brotli gem (0.9.1). curl_cffi has no fixed release yet.
- Envoy and Istio with the Brotli decompressor enabled. Envoy is fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12.
- System libbrotli packages. Check your distribution's advisory.
What should you do?
Patch now, regardless of the high exploitation complexity. Node.js published no workaround, so upgrading is the only fix.
- Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, or Bun 1.4.4. Update Brotli bindings, proxies and system libbrotli to the fixed versions above.
- Rebuild every container image on a fresh base. Rebuild single executable applications and bun build --compile binaries too, since each carries its own runtime.
- Restart every Node.js and Bun process so none keeps running the old binary.
- Deal with end-of-life runtimes. Migrate Node.js 20 and older to a supported line, use a vendor LTS build, or take them off the internet.
If you cannot patch right away, these steps reduce exposure but do not fix the flaw:
- Reject Content-Encoding: br at the WAF, reverse proxy or load balancer. Match br case-insensitively, including inside lists such as gzip, br.
- Turn off inflation in your body parsers (inflate: false). This rejects every compressed body, gzip included.
- Neither step covers Brotli responses read by fetch(). Only patching does.
- Alert on node or bun processes spawning shells, interpreters or download tools such as curl and wget.
If an internet-facing service ran a vulnerable version after 21 October, check it for compromise. Look for Brotli decoder errors, unexpected crashes and unexpected child processes, then rotate the credentials it held: database passwords, API keys, application secrets and cloud tokens. The bug can leak memory even when code execution fails.
How Ethiack helps
Ethiack's continuous testing now detects node2shell across your attack surface. We identify every internet-facing Node.js and Bun services you expose, including hosts outside your known inventory, and flag those still running vulnerable or end-of-life versions.
We validate which assets actually decode attacker-controlled Brotli, so your team can patch the right systems first. We would like to thank Assetnote for sharing a high fidelity scanner that contributed to our validation mechanism.
References
- Node.js: October 2026 security releases
- Assetnote node2shell-scanner
- CVE-2026-111497 record
- GitHub advisory GHSA-9v8h-qqgm-4m35
- google/brotli fix commit 0ed4268a
- Imperva: Node2Shell, from Brotli data to remote code execution
- Semgrep: Patch your Node and eat your Brotli
- Cycode: node2shell, what to patch
- Bun v1.4.4 release notes
Tracked on Ethiack Zero. Validate your exposure before attackers do. Try Ethiack: 30-day free trial, no commitment.