Node2Shell: Node.js Brotli Bug CVE-2026-111497 Now Has a Working RCE Exploit

What Node.js fixed on October 21

Node.js published security releases on Wednesday, October 21, 2026 for all three supported lines. The fixed versions are v22.23.4, v24.22.1 and v26.12.1. Anything older on the 22.x, 24.x or 26.x lines is affected.

The release closes 10 CVEs: four rated High, three Medium and three Low by the Node.js project. The one that matters most is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles and exposes through node:zlib.

Node.js credits the report to OpenAI Codex Security researchers Khai Tran and Sylvie Mayer. The fix was handled by Node.js maintainers Matteo Collina (mcollina) and Antoine du Hamel (aduh95).

How the Brotli bug works

In its advisory, Node.js describes the flaw this way: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer."

In plain terms, a malformed stream should have stopped the decoder with an error. Instead the decoder treated it as "send me more data" and kept writing incoming bytes past the end of a tiny fixed buffer. Node.js says an attacker who can supply Brotli data that an application decompresses with node:zlib "can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution."

The bug is not in Node-specific code. It sits in Google's Brotli library itself (c/dec/decode.c), versions 1.0.3 through 1.2.0, on all platforms. Google, acting as the CVE numbering authority, published the record on October 22 and lists fixed Brotli releases 1.0.10, 1.1.1 and 1.2.1. The record maps the flaw to CWE-787 (Out-of-bounds Write) and CWE-252 (Unchecked Return Value).

According to Imperva, "The upstream Brotli fix makes the decoder return a format error for the invalid transition and pass it to the caller."

Node2Shell: from compressed bytes to code execution

On October 22, Imperva researcher Ron Masas published "Node2Shell", a proof of concept that turns the memory corruption into real code execution. The name comes from Imperva's research, not from the Node.js project.

Imperva says it achieved code execution on the official Node.js 24.22.0 Linux arm64 image "without debugger or instrumented binary". The patched 24.22.1 build rejected the same inputs.

The researchers tested two routes into the native decoder:

• A Brotli-compressed HTTP response consumed by Node's built-in fetch(). Here the victim is a Node process that talks to a hostile or compromised server.
• Incoming request bodies parsed by Express 5.0.0-5.3.0 with body-parser 2.0.0-2.3.0, through both the raw() and json() parsers. Here the attacker simply sends a request with Content-Encoding: br.

Imperva is candid that the exploit is not a one-shot: "Execution took multiple attempts in our setup." A separate public proof of concept released the same day reached only a crash and a limited read of process memory on standard builds, not code execution. Reliability will vary by platform and build, but a crash alone is a denial of service for any exposed server.

Who is exposed

The deciding question is whether your Node.js process decompresses Brotli data that someone else controls. That covers more code than most teams expect:

• HTTP servers that accept request bodies with Content-Encoding: br, including Express 5 apps using body-parser with its default inflate behaviour.
• Services, crawlers, webhooks and proxies that call fetch() against third-party or user-supplied URLs.
• WebSocket servers or clients with Brotli-compressed frames.
• Any code that passes untrusted input to zlib.brotliDecompress or a Brotli decompression stream.

Node is often bundled inside container images, desktop apps and single-executable builds, where it may not show up in a package inventory. Those copies need the same update.

Because the bug lives in Brotli itself, other software that ships Brotli 1.0.3-1.2.0 is affected too. Cyber Kendra also advises updating Bun to 1.4.4 and the Python Brotli package to 1.2.1; we have not confirmed those versions against Bun or PyPI.

High or critical? Reading the ratings

The labels differ depending on who you ask. Node.js lists CVE-2026-111497 as High in its own advisory. The CVE record from Google scores it 9.2 Critical under CVSS v4.0, with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

The AT:P part ("attack requirements present") is the honest caveat: exploitation depends on the target decompressing attacker-controlled Brotli. No login or user interaction is needed once that condition holds.

CISA's SSVC enrichment from October 23 records Exploitation as "none", Automatable as "no" and Technical Impact as "total". As of October 23 the CVE was not in CISA's Known Exploited Vulnerabilities catalog and no source had reported attacks in the wild. With a public RCE write-up now available, that window is unlikely to stay open for long.

The other nine CVEs in the release

The same releases fix nine more issues. Most are TLS and Permission Model weaknesses that matter for specific setups:

High

• CVE-2026-105482: dns.resolve truncates names that contain a NUL character.
• CVE-2026-105483: TLS certificate hostname check can be bypassed when the IP is written in fullwidth digits.
• CVE-2026-106069: TLS certificate hostname check can be bypassed when the host loosely resolves to an IP address.

Medium

• CVE-2026-105481: a keep-alive socket processes a response written before the request was sent.
• CVE-2026-106072: improper certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpoints.
• CVE-2026-106074: crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and single executable applications.

Low

• CVE-2026-106070: ZipFile returns attacker-controlled prefix bytes after a failed ZIP header validation.
• CVE-2026-106071: Permission Model filesystem over-grant via wildcard radix lookup.
• CVE-2026-106073: Permission Model bypass with fs.realpathSync.

What to do now

1. Check every runtime you operate, including CI runners, containers and bundled apps, and upgrade to 22.23.4, 24.22.1, 26.12.1 or newer.
2. Rebuild container images on a patched Node base image and redeploy. Pulling a new image does nothing for containers that are already running.
3. Move anything on Node 20.x, 23.x or 25.x to a supported line. Those versions will not be fixed.
4. If you cannot patch today, strip or reject Content-Encoding: br at your proxy or load balancer, set inflate: false in body-parser to refuse encoded bodies, and avoid decompressing Brotli from untrusted sources.
5. Treat WAF rules as a stopgap only. They narrow the exposure but do not remove the bug.

# Check the running version
node -v
# Safe: v22.23.4, v24.22.1, v26.12.1 or newer

# Upgrade with nvm
nvm install 24.22.1

# Rebuild containers on a patched base image
docker pull node:24.22.1

Hosting platforms have started to react. Vercel deployed WAF rules on October 21 to block inbound attacks for all projects and is rolling patched Node versions across its managed runtimes, but says the WAF "reduces exposure but does not replace patching". Vercel users still on Node.js 20.x must switch to 22.x or 24.x and redeploy, and self-hosted apps must be rebuilt on patched base images. Imperva has added dedicated WAF rules for CVE-2026-111497 as well.

A second AI-found server bug in a week

Node2Shell lands two days after PHP2Shell, another critical server-side flaw that we covered on October 22. This time the bug was found by OpenAI's Codex Security team, while the working exploit was built by human researchers at Imperva.

Imperva draws the obvious conclusion: "AI can accelerate both vulnerability discovery and exploit development, helping researchers investigate flaws while lowering the time and effort attackers need to turn those flaws into working attacks." For defenders, that means the gap between an advisory and a usable exploit keeps shrinking, and patch windows measured in weeks are no longer safe for internet-facing services.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• CVE record CVE-2026-111497 - https://www.cve.org/CVERecord?id=CVE-2026-111497
• Imperva: Node2Shell, from Brotli data to remote code execution - https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
• Vercel: Node.js security advisory - https://vercel.com/kb/bulletin/node-js-security-advisory
• Rescana: Node.js CVE-2026-111497 Node2Shell analysis - https://www.rescana.com/post/nodejs-cve-2026-111497-node2shell-brotli-rce-october-2026
• Cyber Kendra: Node.js October 2026 security releases - https://www.cyberkendra.com/2026/10/nodejs-october-2026-security-releases-cve-2026-111497.html

Key takeaways

• CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder (1.0.3-1.2.0), bundled in Node.js and reachable through node:zlib.
• Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1. Node 20.x and older, 23.x and 25.x are end-of-life and get no fix.
• OpenAI Codex Security found the bug; Imperva's Node2Shell showed code execution on Node 24.22.0 Linux arm64, though it took multiple attempts.
• Node.js rates it High; the CVE record scores it 9.2 Critical under CVSS v4.0. No in-the-wild exploitation was reported as of October 23.
• If you cannot patch at once, reject Content-Encoding: br at the edge and set body-parser inflate: false, but treat that and WAF rules as stopgaps only.