Skip to content
THREATWIRE
CriticalPoC Available

CVE-2026-111497

Google Brotli decoder out-of-bounds write bundled in Node.js (Node2Shell)

An out-of-bounds write in the Google Brotli decoder (1.0.3 to 1.2.0) lets crafted Brotli data corrupt memory. Node.js bundles it and says it can lead to a crash, memory disclosure or remote code execution. Fixed on 21 October 2026 in Node.js 22.23.4, 24.22.1 and 26.12.1, and in Brotli 1.0.10, 1.1.1 and 1.2.1. CVSS 4.0 9.2. Not in CISA KEV.

By ThreatWire Desk · Published 22 Oct 2026 · Updated 24 Oct 2026

CVSS
9.2
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Class
RCE
Status
PoC Available
KEV
Not in CISA KEV
0-day
No
Vendor
Google (Brotli), bundled in Node.js
Products
Brotli, Node.js, brotli (PyPI), brotlicffi (PyPI), Bun, Envoy, Istio
Affected
Google Brotli 1.0.3 to 1.2.0 (1.0.3 before 1.0.10, 1.1.0 before 1.1.1, 1.2.0 before 1.2.1). Node.js 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1. End-of-life Node.js lines are also affected and get no fix. PyPI brotli before 1.2.1 and brotlicffi before 1.2.1.0, per GHSA. Bun 1.0.21 to 1.4.3. Envoy 1.39.2, 1.38.5, 1.37.7 and 1.36.11 per its advisory, when the Brotli decompressor is configured. Istio 1.31.0 to 1.31.1, 1.30.0 to 1.30.5 and 1.29.0 to 1.29.8.
Fixed
Node.js 22.23.4, 24.22.1 and 26.12.1 (21 October 2026). Brotli 1.0.10, 1.1.1 and 1.2.1 (21 October 2026). PyPI brotli 1.2.1 and brotlicffi 1.2.1.0. Bun 1.4.4. Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Istio 1.31.2, 1.30.6 and 1.29.9. Debian brotli 1.0.9-2+deb12u1 (bookworm) and 1.1.0-2+deb13u1 (trixie).
CWE
CWE-787, CWE-252
Published
22 Oct 2026
Updated
24 Oct 2026

The status above is the claim. Links do not upgrade it.

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder. Node.js bundles that decoder. Researchers call the bug Node2Shell.

Node.js disclosed it on 21 October 2026 in its security releases. The advisory title says the flaw "permits remote code execution". Node.js rates it High.

Node.js explains the cause. An invalid block switch was treated as a need for more input, not as a format error. The decoder then kept writing into a small internal buffer. An attacker who can feed Brotli data to an app that decompresses it with node:zlib can corrupt memory. Node.js says this can cause a crash, a memory leak or remote code execution.

Fixed versions: Node.js 22.23.4, 24.22.1 and 26.12.1. Google fixed Brotli in 1.0.10, 1.1.1 and 1.2.1 the same day. End-of-life Node.js lines get no fix.

The CVE record comes from Google. It covers Brotli 1.0.3 to 1.2.0. Google scores it CVSS 4.0 9.2 (Critical). The full vector is in the CVSS field. NVD published it on 22 October 2026 and has not done its own analysis yet.

GitHub advisory GHSA-9v8h-qqgm-4m35 adds the Python packages. PyPI brotli is fixed in 1.2.1 and brotlicffi in 1.2.1.0.

Beyond Node.js (updated 24 October 2026). Vendors confirm other fixes. Bun 1.4.4 (advisory GHSA-663w-cv8g-jj2p). Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8 (GHSA-3wvj-j6qm-62mr), when the Brotli decompressor is configured. Istio 1.31.2, 1.30.6 and 1.29.9 (ISTIO-SECURITY-2026-007). Debian ships fixed brotli packages. Red Hat rates it Important.

Node.js credits Khai Tran and Sylvie Mayer (OpenAI Codex Security) for the report. Matteo Collina and Antoine du Hamel fixed it.

Exploit status: Imperva published its Node2Shell research on 22 October. It ran code in a lab on the official Node.js 24.22.0 arm64 image, after several attempts. A public PoC by dimasma0305 reports RCE in specific lab setups only. ThreatWire read the README and did not run it.

The CVE is not in CISA KEV (catalog 2026.10.23). No exploitation in the wild has been reported.

Read the full story.

Sources

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/cve/cve-2026-111497