Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

What it is

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in the Brotli decoder that Node.js bundles. Malformed compressed input can make the decoder write past the end of a buffer. Node.js rates it high, one step below critical, and describes the impact as remote code execution. The page also lists crashes and partial memory leaks as outcomes. Bun before 1.4.4 is affected too.

Preconditions / Affected

The decoder runs only when the app decompresses Brotli data an attacker controls. The page names three routes:

• Inbound request bodies: Express 5 and body-parser 2.x decompress bodies sent with Content-Encoding: br, so any client can reach the decoder. A bare Node.js HTTP server does not decode Brotli request bodies.
• Outbound fetch(): responses are decompressed automatically, so an attacker-controlled or compromised server can attack the caller. Webhooks and features that fetch user-supplied URLs are the typical targets.
• Direct node:zlib use: any untrusted input passed to the Brotli functions.

Node.js 25.x, 23.x, 20.x and earlier are end of life and get no fix.

Node.js from a Linux distribution package (Debian, Ubuntu, Fedora, RHEL, Alpine) may link the system Brotli library instead of the bundled copy. In that case the fix arrives through the distribution's Brotli package, so check the distribution advisory as well as the Node version.

What to do

Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 (or a newer patch of the same line), or Bun 1.4.4 or newer. The upstream Brotli fix (commit 0ed4268a, February 2026) also shipped in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software bundling Brotli may need updating.

Containers need a rebuild. An image pinned to node:22.23.3-alpine or node:24.22.0 stays vulnerable until the pin moves to a patched version. Managed platforms with their own bundled runtime may lag upstream.

Finding exposure:

node --version
docker run --rm <image> node --version
npm ls express body-parser

Also search code and dependencies for brotliDecompress and createBrotliDecompress from node:zlib, and list outbound fetch() calls to servers you do not control. Upgrade services that match these first.

Stopgaps, since the Node.js advisory lists no workaround:

• Drop requests with Content-Encoding: br at the reverse proxy, load balancer or application middleware. The author's company used this on internal services that could not be upgraded at once.
• Vercel added firewall rules on 21 October 2026 that block the attack in inbound requests.

Caveats

Neither stopgap covers Brotli responses the app fetches from other servers. Only a runtime upgrade removes the flaw.

A first public proof of concept (22 October 2026) reached code execution only against a deliberately weakened build. Researchers the same day reported code execution on the unmodified Node.js 24.22.0 image on Linux arm64, but the exploit did not work on every attempt, and 24.22.1 rejects the same input. Per The Hacker News, no exploitation in the wild had been reported as of 22 October 2026. The page still advises treating it as urgent.