Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

What it is

CVE-2026-111497 ("Node2Shell", also called HTTP2Shell and Broccoli2Shell) is an out-of-bounds write in Google's Brotli decoder. The decoder can write past the end of a buffer when it processes specially crafted input. Node.js says the result can be a crash, a memory leak, or arbitrary code execution by an unauthenticated attacker. Node.js credits the discovery to OpenAI Codex Security, found during red-teaming.

Preconditions / Affected

Brotli 1.0.3 through 1.2.0 is affected. Exploitation needs attacker-controlled data to reach an affected decoder. OpenAI's Patch the Planet advisory names three paths: compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files. A library that decompresses content on the application's behalf is enough.

Imperva's demonstration used the official Node.js 24.22.0 image for Linux arm64. It delivered the payload in a server response fetched by the application and in a request body handled by Express 5 or body-parser 2.

What to do

Upgrade to a fixed Brotli: 1.0.10, 1.1.1 or 1.2.1. Patched downstream releases named on the page:

• Node.js and the PyPI packages Brotli (1.2.1) and brotlicffi (1.2.1.0), released the week before 25 October 2026.
• Microsoft, 25 October 2026: .NET 8.0.33, 9.0.22 and 10.0.14, .NET 11 Release Candidate 3, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4, 7.5 and 7.6.
• Bun, Envoy and Istio have also shipped updates. The page gives no version numbers for them.

Restart affected services after patching, because running processes keep the vulnerable code. Rebuild container images on top of a patched base.

Software that bundles its own Brotli decoder needs separate checking. A public tracker lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched. Its maintainers say the list is incomplete and that not every configuration exposes the vulnerable code.

Caveats

Severity ratings differ. Google gave CVSS v4 9.2. Microsoft classes it as elevation of privilege with CVSS v3.1 8.1, critical for .NET and Visual Studio, important for PowerShell, and "Exploitation More Likely".

Exploitation is not reliable in public evidence. Imperva said its proof "did not succeed on every attempt" and covers only the tested Linux arm64 build and application setups. It has not released its exploit. A GitHub proof of concept reportedly achieves code execution only on an intentionally weakened build. Some researchers argue the bug allows only denial of service. No in-the-wild exploitation has been reported.

OpenAI says the root cause was fixed in the Brotli source in February 2026, before anyone knew it was a vulnerability, but no release carried the fix until the new versions.