Node2Shell Brotli Flaw Enables Node.js Code Execution and Exposes Other Software

A high-severity vulnerability in Google’s Brotli decoder, CVE-2026-111497, has prompted security updates across Node.js and other software that embeds the library. Dubbed Node2Shell, the out-of-bounds write can cause crashes, process-memory disclosure, or potentially remote code execution when applications decompress attacker-controlled data. Exposure includes compressed request bodies, automatically decoded outbound HTTP responses, and direct decompression operations—not every application using an affected runtime is exploitable. Imperva demonstrated intermittent code execution against the official Node.js 24.22.0 Linux ARM64 image; exploitation required multiple attempts and was not established across other architectures or all affected versions. No in-the-wild exploitation had been reported in the supplied coverage. The shared decoder also affects Bun, Python’s Brotli and brotlicffi packages, and downstream products including Envoy and Istio, although Python testing did not demonstrate memory corruption or code execution.

Organizations should prioritize services that decode untrusted network traffic and upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, or later fixed releases; unsupported branches require migration. These Node.js releases also address TLS validation, DNS input handling, cryptographic randomness, and other security issues. Bun users should upgrade to 1.4.4 or later; Python package fixes include Brotli 1.2.1 and brotlicffi 1.2.1.0. Separately bundled or statically linked Brotli copies require their own updates, so patching Node.js alone does not resolve every exposure. Rebuild and redeploy containers, executables, and affected artifacts, restart processes, and verify deployed versions. Blocking inbound Brotli requests provides only partial protection because applications may also decode malicious responses from external servers. Where updates are unavailable, restrict untrusted Brotli decoding and monitor for decoding errors, crashes, and suspicious process activity.