The Node2Shell vulnerability is one of the most urgent Node.js security stories of October 2026. Tracked as CVE-2026-111497, it is a flaw in the Brotli decoder bundled with Node.js that can let a remote, unauthenticated attacker crash an application, leak sensitive memory, or potentially run their own code on your server. Patches shipped on October 21, 2026, and on October 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, with a federal remediation due date of November 10, 2026.
What makes this flaw so broad is its location: it sits inside the Node.js runtime itself, not in one npm package you can swap out, and your app may decode Brotli data automatically. This guide explains what it is, who is affected, and how to patch it.
What Is the Node2Shell Vulnerability?
The Node2Shell vulnerability, CVE-2026-111497, is an out-of-bounds write (CWE-787, rooted in an unchecked return value, CWE-252) in Google’s Brotli decoder (c/dec/decode.c). Brotli is Google’s lossless compression format for shrinking web traffic, negotiated via the Content-Encoding: br header and decompressed by many frameworks behind the scenes.
In simple terms, a Brotli stream announces the block types it will use as decoding proceeds. A crafted stream can reach a block change the stream’s own structure had already ruled out. The vulnerable decoder treats that invalid state as a request for more input and keeps going instead of stopping with an error, writing past its buffer into adjacent memory. That corruption can cause a denial of service, disclose memory contents, or allow arbitrary code execution.
Google, acting as the CVE Numbering Authority (CNA), scores it 9.2 Critical on CVSS 4.0. Node.js rates its impact as High and describes it as a Brotli decoder out-of-bounds write permitting remote code execution. It was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security. HTTP2Shell and Broccoli2Shell are nicknames for the same CVE, not separate flaws.
Who Is Affected by the Node2Shell Vulnerability?
Anyone running a supported Node.js version that decompresses attacker-controlled Brotli data is affected — and more paths lead to the decoder than most teams expect:
- Explicit decompression with
node:zlib. Code callingzlib.brotliDecompress(),zlib.brotliDecompressSync(), orzlib.createBrotliDecompress()feeds data directly to the vulnerable decoder. - Built-in
fetch()responses. Node.js’sfetch()transparently decodes responses sent withContent-Encoding: br, so a malicious response from another server can reach the decoder with no explicit decompression code on your side. - Body-parsing middleware. Frameworks that inflate compressed request bodies expose the decoder to inbound traffic; in body-parser 2.x, used by Express 5,
express.json()decodes Brotli request bodies by default.
The vulnerable component is compiled into the Node.js binary — not the separate npm package named brotli — so updating dependencies alone will not fix it. Because the bug lives in Google’s Brotli library, it also affects Python’s Brotli packages, Bun, Envoy, .NET, and curl builds linked against libbrotli, each with its own fix.
How to Check If Node.js Is Vulnerable
Checking takes less than a minute — run this on every server, container image, CI runner, and machine that runs Node.js:
node --version
Then compare the result against the fixed versions below. If your version is below the fixed release for your line, you are running a vulnerable decoder — even if your code never mentions Brotli. Check for multiple installations on the same host, since version managers, system packages, and Docker images can each carry a different version, and check your distribution’s advisory if you installed Node.js through a Linux package.
Node2Shell Vulnerability: Fixed Versions and Patch Table
The October 21, 2026 security release fixed all three supported lines. You upgrade within your own line, which keeps the change small and safe.
| Runtime / package | Fixed version |
|---|---|
| Node.js 22.x | 22.23.4 |
| Node.js 24.x | 24.22.1 |
| Node.js 26.x | 26.12.1 |
| Brotli (upstream library) | 1.0.10, 1.1.1, or 1.2.1 |
| Bun | 1.4.4 or newer |
| Python Brotli package | 1.2.1 |
| Python brotlicffi package | 1.2.1.0 |
One hard truth: Node.js 20 and older receive no fix. Those lines are end of life, so if you are still on Node.js 20, 18, or older in production, migration to a supported line is the only complete fix — and it should not drift, since this is now KEV-listed.
How to Patch the Node2Shell Vulnerability
For supported versions, follow these steps and test before rolling out to production:
- Upgrade Node.js within your release line. Move 22.x to 22.23.4, 24.x to 24.22.1, or 26.x to 26.12.1, and pin the new version so a rebuild does not silently roll you back.
- Rebuild and redeploy container images. Updating Node.js on a host does not fix an image that bundles its own old runtime.
- Update the other runtimes on the same host. Upgrade Bun, Python Brotli, and brotlicffi where installed, and apply the relevant fixes for Envoy, .NET, or other libbrotli-linked software you run.
- Restart every affected process. The upgrade only takes effect when the process restarts on the new binary — check long-running workers and queue consumers too.
- Verify after the upgrade. Run
node --versionagain on each host and container, and confirm monitoring shows the new version in production. A patch installed but never deployed is not a patch.
Run your test suite and a smoke test of your flows afterward; compression sits deep in the stack, so check uploads, API calls, and integrations. For background, see Aikido’s Node2Shell analysis and SecurityWeek’s report on the CISA listing.
Workarounds If You Cannot Patch Immediately
If an upgrade cannot ship today — a legacy dependency, a frozen release window, or an end-of-life line awaiting migration — shrink the paths to the decoder until it lands:
- Disable Brotli decoding where you control it, if your app does not need it.
- Reject inbound requests with
Content-Encoding: brat your reverse proxy or load balancer. - Remove
brfromAccept-Encodingon outbound requests, so upstream servers do not send Brotli responses your runtime would decode automatically.
Treat these as a bridge, not a destination — they reduce exposure but do not fix the flaw. For help prioritizing an upgrade, see our services or contact us.
Why CISA’s KEV Listing Changes the Urgency
CISA adds a flaw to the KEV catalog when it has evidence of active exploitation, and federal agencies must then remediate by the due date — here, November 10, 2026. Even if you are not a federal agency, the listing is a strong signal: exploitation attempts have been observed, public proof-of-concept code is circulating, and researchers have demonstrated code execution on an official Node.js 24.22.0 image. Timeline: patched October 21, proof-of-concept work within days, KEV listing October 27. Assume an internet-facing Node.js service will be probed. For hardening guidance, see our cybersecurity strategies guide and SOCRadar’s breakdown for Python packages.
FAQ: Node2Shell Vulnerability
What is the Node2Shell vulnerability?
It is CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. A remote, unauthenticated attacker can send a crafted Brotli stream that corrupts decoder memory, potentially crashing the app, leaking memory, or executing code.
Which Node.js versions fix CVE-2026-111497?
Node.js 22.23.4, 24.22.1, and 26.12.1. Upgrade within your current line: 22.x to 22.23.4, 24.x to 24.22.1, and 26.x to 26.12.1. Node.js 20 and older have no fix and must be migrated to a supported line.
How do I check if my Node.js is vulnerable?
Run node --version on every server and container. Below the fixed release for its line, it is vulnerable. Check for multiple installations and rebuilt images, since patching one copy does not patch the others.
Is the Node2Shell vulnerability being exploited in the wild?
CISA added it to KEV on October 27, 2026, indicating evidence of active exploitation, and firms have reported attempts against honeypots. No victim has been publicly named, but the public exploit plus KEV listing make immediate patching the right call.
What should I do if I cannot patch Node.js right away?
Disable Brotli decoding where possible, reject inbound requests with Content-Encoding: br, and remove br from Accept-Encoding on outbound requests. Use those steps only as a temporary bridge while you schedule the upgrade or migration.
Conclusion: Patch the Node2Shell Vulnerability Now
The Node2Shell vulnerability combines a severe memory flaw, a widely used runtime, attack paths most developers never think of as decompression code, an available patch, and a KEV listing confirming exploitation attempts. That leaves little room for delay. Check every installation with node --version, upgrade to 22.23.4, 24.22.1, or 26.12.1, rebuild your images, restart your processes, and verify the new version is running. On Node.js 20 or older, start migrating now — no patch is coming. Patching today is routine; explaining a breach next week is not.
