Node2Shell (CVE-2026-111497): Node.js Brotli RCE Vulnerability Explained

Key Takeaways

• Node2Shell, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js, rated CVSS 9.2.
• The decoder ignores an invalid block-type switch, continues from a corrupted state, and writes past its buffer.
• Node.js 22.23.4, 24.22.1, and 26.12.1 fix the flaw, while end-of-life lines 20.x and 25.x remain vulnerable.
• Bun up to 1.4.3 is affected, and distribution Node.js builds may need a patched system Brotli package.
• Attackers sending or serving crafted Brotli streams can crash services, leak memory, and execute code remotely.
• Successful exploitation lets attackers open reverse shells, steal cloud credentials, deploy cryptominers, and pivot to other systems.
• The Picus Threat Library includes the Node2Shell Web Attack Campaign to simulate CVE-2026-111497 attacks against your defenses.

Node2Shell (CVE-2026-111497, also tracked as HTTP2Shell) is an out-of-bounds write in the Brotli decoder that Node.js bundles. It scores 9.2 (Critical) on CVSS v4.0 and has been shown to give remote code execution on an official Node.js build [1]. Node.js shipped fixes on October 21, 2026 and exploitation in the wild was confirmed on October 26.

What is Brotli?

Brotli is a lossless compression format and open-source C library developed by Google and standardized as RFC 7932. It combines LZ77, Huffman coding and context modeling with a built-in dictionary of common web strings, which usually compresses text better than gzip. Browsers, CDNs and web servers negotiate it through the HTTP header Content-Encoding: br.

Node.js exposes Brotli through its built-in zlib module (createBrotliCompress(), createBrotliDecompress()) and through fetch(), which decompresses br responses automatically. Node.js bundles its own copy of the Brotli library, while some Linux distribution builds link against the system brotli package instead. Bun bundles Brotli as well. Because the decoder is native C code, a memory-safety bug in it becomes reachable from JavaScript whenever an application decompresses data it does not control.

How Node2Shell Works?

The root cause is a decoder that treats an impossible stream state as "needs more input" and keeps going. The CVE record places the overflow in c/dec/decode.c and lists two weaknesses: out-of-bounds write (CWE-787) and unchecked return value (CWE-252) [4].

A Brotli stream declares which block types are available as decoding progresses. The crafted stream declares only one block type, then asks the decoder to switch block types, a transition its own structure makes impossible. A correct decoder stops with an error. The unpatched decoder confuses this invalid input with incomplete input [6], ignores the error and continues from a corrupted internal state, writing past the end of its buffer.

The fix is small. Node.js cherry-picked upstream Brotli commit 0ed4268a, which makes the decoder fail immediately on a block switch when only one block type is declared [3], [5]. Node.js also added a new error constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. On patched builds, the same malicious inputs are rejected with a format error before any code can run.

Node2Shell Affected Versions and Products

The bug lives in Brotli, not in Node.js code, but Node.js bundles its own copy, so fixing it means updating the runtime itself.

Beyond the official Node.js builds, several other components need their own check:

• Google Brotli library: versions 1.0.3 through 1.2.0 are vulnerable; 1.0.10, 1.1.1 and 1.2.1 are fixed. Any software bundling a build in that range deserves a vendor inquiry.
• Linux distribution packages: Debian, Ubuntu, Fedora, RHEL and Alpine Node.js packages may link against the system Brotli library. There, the fix arrives through the distribution's brotli package, and the Node.js version number alone does not tell you whether an instance is patched. Debian 12 and 13 now ship a fixed brotli [2], [9].
• Bun: all versions up to 1.4.3 are affected; 1.4.4 includes the fix [8].
• Package managers: Homebrew still shipped vulnerable node 26.12.0, node@24 24.22.0 and node@22 22.23.3 about 10 hours after the release [2], so verify rather than assume.

Node2Shell Impact

An attacker who can send a crafted Brotli stream to a vulnerable Node.js service, or make the service fetch one, can do the following [2], [7]:

• Crash the service (denial of service): a single malformed stream terminates the Node.js process, and repeated requests keep it down.
• Read process memory: the out-of-bounds write can leak memory contents such as credentials, tokens and session data.
• Execute arbitrary code remotely: run attacker-supplied code inside the Node.js process with that process's privileges.
• Take over the workload: open a reverse shell, steal environment secrets and cloud credentials, install malware or cryptominers, and pivot to other systems.

How Picus Simulates Node2Shell (CVE-2026-111497) Attacks?

We strongly suggest simulating CVE-2026-111497 attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the CVE-2026-111497 attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] Imperva Red Team, "Node2Shell: From Brotli data to remote code execution," Imperva Blog, Oct. 22, 2026. [Online]. Available: https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/. Accessed: Nov. 3, 2026.

[2] Sysdig Threat Research Team, "Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE," Sysdig Blog, Oct. 24, 2026 (updated Oct. 28, 2026). [Online]. Available: https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce. Accessed: Nov. 3, 2026.

[3] Node.js Project, "October 2026 security releases," Node.js Blog, Oct. 21, 2026. [Online]. Available: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases. Accessed: Nov. 3, 2026.

[4] National Institute of Standards and Technology, "CVE-2026-111497," National Vulnerability Database. [Online]. Available: https://nvd.nist.gov/vuln/detail/cve-2026-111497. Accessed: Nov. 3, 2026.

[5] Google, "Brotli commit 0ed4268a," GitHub. [Online]. Available: https://github.com/google/brotli/commit/0ed4268a4401abcb44720963. Accessed: Nov. 3, 2026.

[6] Semgrep, "Patch your Node and eat your Brotli, or you won't get dessert," Semgrep Blog, 2026. [Online]. Available: https://semgrep.dev/blog/2026/patch-your-node-and-eat-your-brotli-or-you-wont-get-dessert/. Accessed: Nov. 3, 2026.

[7] ELLIO, "Node2Shell (CVE-2026-111497): RCE on stock Node.js builds," ELLIO Blog, 2026. [Online]. Available: https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/. Accessed: Nov. 3, 2026.

[8] Aikido Security, "Node2Shell: Node.js Brotli RCE (CVE-2026-111497)," Aikido Blog, 2026. [Online]. Available: https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497. Accessed: Nov. 3, 2026.

[9] Debian Security Team, "CVE-2026-111497," Debian Security Bug Tracker. [Online]. Available: https://security-tracker.debian.org/tracker/CVE-2026-111497. Accessed: Nov. 3, 2026.