What is CVE-2026-111497?

It's an out-of-bounds write in Google's Brotli decoder, nicknamed Node2Shell. Malformed compressed input can corrupt memory, causing a crash, a memory leak or possibly remote code execution. Node.js rates it High and fixed it on October 21, 2026.

Which Node.js versions fix Node2Shell?

Node.js 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x and 25.x are end-of-life and will not receive a patch, so move those services to a supported line.

Is Express 4 affected by Node2Shell?

The runtime is still vulnerable, but Express 4's default body-parser 1.20.x doesn't decode Brotli request bodies, per Sysdig. Other middleware or your own fetch() and zlib calls might still reach the decoder, so update Node.js anyway.

Does updating Node.js fix my Docker image?

Only after you rebuild it. An image pinned to an old tag such as node:22.23.3-alpine keeps the vulnerable decoder until it's rebuilt on a patched Node.js version.

Is Node2Shell being exploited in the wild?

Help Net Security reports it was added to CISA's Known Exploited Vulnerabilities catalog on October 27, 2026, and that ELLIO observed exploit traffic. Reliable remote code execution is disputed, but crashes are easy to trigger.

Node2Shell Brotli Flaw Is Exploited: What to Patch Now

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js, and CISA added it to its Known Exploited Vulnerabilities catalog on October 27. Node.js shipped fixes on October 21 in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and 25 are end-of-life and won't get one, so if a service of yours decompresses Brotli from untrusted sources, update the runtime and rebuild your images.

Reports disagree on how reliably the bug gives an attacker a shell, so this post separates what's confirmed from what isn't.

Key Takeaways

The bug is in Google's Brotli decoder, not in Node.js code. Node.js bundles Brotli, so only a runtime update removes it.
Fixed: Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.0.10, 1.1.1 and 1.2.1, and Bun 1.4.4.
Reachable paths include Express 5 with express.json(), server-side fetch() and direct node:zlib Brotli calls.
Crashes are easy to trigger. Code execution has been shown on the official node:24.22.0 image, but not reliably.
Rebuild container images. A pinned tag on an old Node.js version stays vulnerable.

What is Node2Shell and how does the Brotli bug work?

According to the Node.js advisory, the bundled decoder treated an invalid block switch as a request for more input instead of a permanent format error. The streaming decoder then kept appending input to an eight-byte internal buffer and wrote past its end. Node.js rates it High, and the impact it lists is a crash, a process memory leak or remote code execution.

Sysdig's analysis adds that Google's CVE record scores it 9.2 under CVSS v4.0, and that the upstream fix is Brotli commit 0ed4268a. Help Net Security reports that the fix was committed to the Brotli repo in February 2026 with no release or advisory, and sat publicly readable for about eight months before Node.js disclosed the flaw.

The Node.js advisory credits the report to OpenAI Codex Security researchers Khai Tran and Sylvie Mayer. The Node2Shell name comes from Imperva, per CSO Online, and some later coverage uses HTTP2Shell or Broccoli2Shell for the same CVE.

Which versions are fixed?

Node.js 26.x: 26.12.1. Node.js 24.x: 24.22.1. Node.js 22.x: 22.23.4.
Node.js 20.x and 25.x are end-of-life and unpatched. Aikido lists 23.x and earlier as unpatched too.
Bun: 1.4.4 or newer. Versions up to 1.4.3 are affected, per Sysdig.
Brotli library: 1.0.10, 1.1.1 and 1.2.1. Sysdig cites the CVE record's affected range as 1.0.3 through 1.2.0.
Python: CSO Online lists the brotli package fixed in 1.2.1 and brotlicffi in 1.2.1.0.
Microsoft .NET: CSO Online reports out-of-band updates on October 25 (8.0.33, 9.0.22, 10.0.14). Self-contained and Native AOT apps need a rebuild, because updating the shared runtime doesn't change a decoder linked into your executable.

Linux distributions that build Node.js against the system Brotli library get the fix through their brotli package, so a Node.js version number alone may not tell you whether an instance is patched.

Is my app actually reachable?

Only if untrusted Brotli data reaches the decoder. Sysdig and Aikido both walk through the common paths:

Express 5 with express.json(): body-parser 2.x decodes request bodies sent with Content-Encoding: br by default. Express 4's body-parser 1.20.x doesn't handle Brotli, but other middleware might.
Server-side fetch(): it decompresses Brotli responses automatically, so a malicious or compromised upstream can reach your app. Sysdig notes this applies even when you send Accept-Encoding: identity.
Koa through co-body, and Fastify with @fastify/compress, per Sysdig.
Direct use of node:zlib Brotli functions, such as createBrotliDecompress(), on attacker-controlled data.

A bare Node.js HTTP server doesn't decode incoming Brotli request bodies by itself, according to Aikido.

Is Node2Shell being exploited, and can it really give a shell?

Exploitation is confirmed at some level. Help Net Security reports CISA's KEV listing on October 27 and exploit traffic observed by ELLIO, whose attribution to a mass-exploitation operator is its own assessment. Public proof-of-concept code exists on GitHub.

Code execution is less settled. Imperva demonstrated it on the official node:24.22.0 image for Linux arm64, though it took several attempts, and the patched 24.22.1 rejected the same input. Sysdig reports that one public PoC depends on a specific binary and memory layout, and that blind remote execution with address randomization wasn't shown. Some researchers argue the realistic impact is denial of service.

The practical read: treat it as potentially RCE-capable, but expect crashes and possible memory disclosure as the likelier outcomes on a hardened host.

What should I do today?

Start by finding every Node.js runtime you run. Aikido suggests these checks:

node --version
docker run --rm <image> node --version
npm ls express body-parser

Then update to 22.23.4, 24.22.1 or 26.12.1 and rebuild and redeploy images. An image pinned to node:22.23.3-alpine stays vulnerable until you rebuild it on a patched version. Move services off Node.js 20 and 25 rather than waiting for a patch that isn't coming.

If you can't upgrade yet, the Node.js advisory lists no workaround, but two stopgaps are in circulation. Aikido rejected requests with Content-Encoding: br at the proxy for internal services it couldn't patch right away. Sysdig suggests turning off request decompression in Express, which also rejects gzip, so test your clients first:

express.json({ inflate: false })

Neither covers Brotli responses your own code fetches from other servers. Only the runtime update does.

For detection, Sysdig recommends watching web-facing Node.js processes for shell spawns and unexpected outbound connections, running them as an unprivileged user, and keeping secrets out of the process environment.

Wrapping Up

Update Node.js to a fixed release, rebuild every image that bundles it, and audit where your code decompresses Brotli from outside sources. Check Bun, Python and .NET services too, since the same decoder bug shows up wherever it's bundled.