Node2Shell: crafted Brotli data runs code in Node.js via CVE-2026-111497

Update, 24 October 2026: The same Brotli flaw reaches beyond Node.js. Bun, Envoy and Istio have published their own advisories and fixes, and so has GitHub for the Python brotli packages. Debian and Red Hat track it too. See the new "Beyond Node.js" section.

What happened

On October 21, 2026, Node.js shipped security releases for the 22.x, 24.x and 26.x lines. One fix is CVE-2026-111497, a flaw in the Brotli decoder that Node.js bundles.

Node.js titles it "Brotli decoder out-of-bounds write permits remote code execution". It rates it High. So the RCE claim comes from Node.js itself, not only from researchers.

NVD published the CVE on October 22. On the same day, Imperva Red Team published its research under the name Node2Shell. This article comes two to three days later, on October 24. The fix is not new. If you have not updated yet, you are behind.

Who is affected

Node.js says 26.x, 24.x and 22.x are affected. End-of-life lines are always affected and get no fix.

The risk is for apps that decompress Brotli data an attacker can control with node:zlib. Imperva tested two such paths:

• Responses read with the built-in fetch().
• Request bodies decoded by Express 5 or body-parser 2 parsers.

Imperva says a bare Node.js HTTP server does not decode incoming Brotli bodies on its own.

The bug sits in Google Brotli 1.0.3 to 1.2.0, not in Node.js code. Other software that bundles that decoder is exposed too. See below.

Beyond Node.js

These projects confirmed the flaw in their own advisories or trackers. Each fix ships its own Brotli update.

• Bun. Advisory GHSA-663w-cv8g-jj2p, published October 23. Bun 1.0.21 to 1.4.3 are affected. Fixed in Bun 1.4.4, which moves Brotli to 1.2.1. Its fetch(), node:zlib and DecompressionStream APIs reach the decoder. Apps built with bun build --compile must be rebuilt.
• Python. GitHub advisory GHSA-9v8h-qqgm-4m35 covers PyPI brotli (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0).
• Envoy. Advisory GHSA-3wvj-j6qm-62mr, published October 23, rates it Critical. Fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Only deployments with the Brotli decompressor configured are exposed.
• Istio. Bulletin ISTIO-SECURITY-2026-007 lists the CVE through Envoy. Fixed in 1.31.2, 1.30.6 and 1.29.9. It matters if you enable Brotli decompression, for example with an EnvoyFilter. 1.29 is end of life.
• Debian. Fixed brotli packages for bookworm (1.0.9-2+deb12u1) and trixie (1.1.0-2+deb13u1, DSA-6582-1). Forky and sid were still listed as vulnerable when we checked.
• Red Hat. Rates it Important. It lists several products as affected, including OpenShift Service Mesh 3 (istio-proxy) and the Python brotli package in Ansible Automation Platform. Most fixes were still pending when we checked.

Note the timeline. Envoy's fixed releases came out from October 6, with a quiet Brotli update. Istio's bulletin followed on October 15. Both predate the public Node.js disclosure. Envoy only published its advisory on October 23.

What is confirmed

• Cause. Node.js says an invalid block switch was read as "need more input", not as an error. The decoder kept writing into an 8-byte buffer.
• Impact. Per Node.js: a crash, a leak of process memory, or remote code execution.
• Fixes. Node.js 22.23.4, 24.22.1 and 26.12.1. Brotli 1.0.10, 1.1.1 and 1.2.1, all released October 21.
• Python. PyPI brotli 1.2.1 and brotlicffi 1.2.1.0 are fixed, per GHSA.
• Score. Google, the CVE issuer, scores it CVSS 4.0 9.2 (Critical). Node.js publishes no number, only "High". NVD has not added its own score.
• Credit. Node.js credits Khai Tran and Sylvie Mayer (OpenAI Codex Security). Matteo Collina and Antoine du Hamel fixed it.
• Node2Shell. Imperva ran code in a test app on the official Node.js 24.22.0 Linux arm64 image. The app created a marker file it had no code to create. It took several attempts. Node.js 24.22.1 rejected the same input.
• Public PoC. A repository by dimasma0305 targets this CVE. It reports RCE in a few pinned x86-64 lab setups. It is probabilistic and tied to those setups. ThreatWire read the README only and did not run it.
• CISA KEV. Not listed (catalog 2026.10.23).

What is not confirmed

• Exploitation in the wild. None reported. CISA's coordinator entry on NVD says "exploitation: none".
• RCE on every build. Imperva tested one build and setup. It did not test 22.x, 26.x or other architectures.
• Reachability. One public analysis argues the bad write cannot be reached and the impact is only a crash. Node.js and Google do not share that view.
• "Far beyond Node.js" lists. Some posts and blogs name more software, such as curl, Electron apps and Java bindings. We list only products whose maintainers confirmed it. Check your own vendors.
• RCE outside Node.js. Bun says it has not tested an attack. Envoy says the flaw could potentially allow code execution. We found no public demonstration against Bun, Envoy or Istio.
• Most GitHub repos. Dozens of repositories now mention this CVE. Most are checkers or labs from unknown accounts. We link only the PoC we checked. Do not run untrusted code.

What to do

1. Update Node.js. Move 22.x to 22.23.4, 24.x to 24.22.1 and 26.x to 26.12.1, or later.
2. Rebuild images. Containers and apps that ship their own Node binary stay vulnerable until rebuilt. Check the version inside each image.
3. Leave end-of-life lines. 25.x, 23.x, 20.x and older get no fix.
4. Update other Brotli copies. Use Brotli 1.0.10, 1.1.1 or 1.2.1. Move Bun to 1.4.4. Update PyPI brotli to 1.2.1 and brotlicffi to 1.2.1.0.
5. Patch proxies. Envoy to 1.40.0, 1.39.3, 1.38.6 or 1.37.8. Istio to 1.31.2 or 1.30.6. Apply distro brotli updates.
6. Find bundled copies. Trail of Bits released Brotli Checker. It looks for vulnerable Brotli copies in projects, packages, containers and stripped binaries.
7. Limit untrusted Brotli for now. Imperva suggests limiting untrusted Brotli traffic on affected paths while you roll out updates. It is not a fix.
8. Watch for crashes. Imperva says unexpected exits during decompression can help you prioritize. They are not proof of an attack.

Related coverage

Imperva links Node2Shell to the recent PHP2Shell research. See our PHP2Shell explainer, released the same day as the Node.js fixes.

Record: CVE-2026-111497. Browse the CVE tracker.

Sources: the Node.js security release post and release notes, Google Brotli releases, NVD, CVE.org, the CISA KEV catalog, GHSA-9v8h-qqgm-4m35, the Bun, Envoy and Istio advisories, the Debian and Red Hat trackers, Imperva and Trail of Bits. Links are in the references list.