CVE-2026-111497 Node2Shell Brotli RCE: what to patch

What happened

27 February 2026: Google committed the upstream fix to the Brotli source, but no Brotli release shipped it for nearly eight months (Aikido; Tenable).
21 October 2026: Node.js disclosed the flaw and released 22.23.4, 24.22.1 and 26.12.1, while Google released fixed Brotli versions 1.0.10, 1.1.1 and 1.2.1 (Imperva; Aikido). Node.js ships it as one of ten vulnerabilities in the October 2026 security release and calls it the most severe (Qualys; Contrast Security).
22 October 2026: Imperva’s Red Team published its analysis, naming the issue “Node2Shell,” and reported code execution against an unmodified Node.js 24.22.0 Linux arm64 image, though it took multiple attempts and did not succeed every time (Imperva). A first public proof of concept appeared the same day, initially working only against a deliberately weakened test build (Aikido). The NVD published the CVE record and PyPI shipped Brotli 1.2.1 (Tenable).
23 October 2026: Aikido reported the blast radius had grown beyond Node.js into Python packages and other HTTP stacks, re-branding it “HTTP2Shell” (Aikido).
26 October 2026: ELLIO reported its sensors recorded an exploitation attempt against Node.js 24.22.0 on x86-64; Tenable says it has not independently confirmed this (Tenable).
27 October 2026: CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog, with a remediation due date of 10 November for federal civilian agencies (Tenable).

Root cause. The flaw is an out-of-bounds write in Google’s Brotli C decoder, in the block-switching logic (Wiz; Akamai). Aikido traces it to DecodeBlockTypeAndLength(), which in vulnerable versions returned a plain boolean where BROTLI_FALSE meant both “malformed” and “need more input,” and the fast path discarded that return value, pairing CWE-252 (unchecked return value) with CWE-787 (out-of-bounds write) (Aikido). A crafted stream signals a block-type switch that its own structure makes impossible; the decoder treats this as a temporary need for more input rather than a format error, keeps appending input to a small internal buffer, and writes past its end (Akamai). The upstream fix (commit 0ed4268a4401abcb4472096340477cf4af7d1a2b) makes the decoder return a dedicated format error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, for the invalid transition (Akamai; Aikido).

Severity. Google, as CNA, scores it CVSS 4.0 9.2 (Critical), with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (Tenable). The 9.2 score is echoed by Qualys and Akamai (Qualys; Akamai). Microsoft rates it 8.1 (CVSS 3.1) for .NET (Tenable). Sources disagree on the headline rating: Node.js’s own advisory rates it “high,” one step below critical, while the CNA score is Critical (Aikido; Akamai).

Attribution. Wiz credits discovery and reporting to Khai Tran and Sylvie Mayer of OpenAI’s Codex Security team, with the Node.js fix implemented by Matteo Collina and Antoine du Hamel, and exploitability demonstrated by Ron Masas of Imperva’s Red Team (Wiz). Aikido likewise says OpenAI’s Codex Security team reported it (Aikido). Imperva phrases it differently, saying the Node.js advisory credits Matteo Collina with reporting and Antoine du Hamel with the fix (Imperva).

How exploitation works

The bug is reachable, unauthenticated and remote, whenever an application decompresses attacker-controlled Brotli data (Wiz; Akamai). It works in both directions: a malicious client can attack an unpatched server, and a malicious or compromised server can attack an unpatched client that accepts compressed responses (Aikido; Wiz). In Node.js the common paths are (Akamai; Aikido):

Express 5 and body-parser 2.x, which decompress Content-Encoding: br request bodies by default (the inflate option defaults to true).
The built-in fetch() API, which auto-decompresses Brotli responses, exposing the client to a hostile server.
Direct calls to zlib.brotliDecompress() or zlib.createBrotliDecompress() on untrusted input.

A bare Node.js HTTP server does not decode incoming Brotli bodies on its own (Imperva; Akamai). Possible impacts range from a process crash through memory disclosure to remote code execution (Wiz).

Exploitation status and reliability. As of 22 October, no in-the-wild exploitation of Node.js had been reported for the CVE, per The Hacker News as cited by Aikido (Aikido). Public PoCs are available on GitHub, but reliability is low and build-specific: Tenable, citing ELLIO, says exploits must be tuned to specific Node.js builds, that one exploit produced nothing in 10,000 attempts against Node.js 22.23.3 and 26.12.0, and that most of 400 lab attempts against an Express server merely crashed the worker, though automatic worker restarts give attackers repeated tries (Tenable).

Blast radius

The flaw lives in the Brotli library, so it reaches every product that bundles or statically links a vulnerable copy, not just Node.js. Brotli has roughly 82.8 million downloads per month (Aikido). Wiz Research reports 91% of cloud environments have resources vulnerable to the CVE and 82% have publicly exposed Node.js instances; Akamai telemetry shows 61% of networks run affected Node.js versions (Wiz; Akamai; Tenable). Python exposure is often indirect, urllib3/requests, httpx[brotli], aiohttp and Scrapy load Brotli when installed, even without an explicit import (Aikido).

Affected and fixed versions

Captured exactly as the sources state them:

Google Brotli / libbrotli, affected 1.0.3 through 1.2.0; fixed in 1.0.10, 1.1.1 and 1.2.1 (Tenable; Wiz).
Node.js, affected < 22.23.4, < 24.22.1, < 26.12.1; fixed in 22.23.4, 24.22.1 and 26.12.1. End-of-life lines (20, 23, 25 and earlier) receive no fix (Tenable; Akamai). (Source lists of which EOL lines exist differ slightly between outlets.)
Bun, affected >= 1.0.21, < 1.4.4; fixed in 1.4.4 (Tenable; Wiz).
Envoy Proxy, fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0 (Tenable; Wiz).
Istio, fixed in 1.29.9, 1.30.6 and 1.31.2 (Tenable).
.NET, fixed in 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3; .NET Framework not affected (Tenable; Aikido).
Python Brotli, affected 1.0.3 to 1.2.0; fixed in 1.2.1. brotlicffi, affected 1.0.3 to 1.2.0.x; fixed in 1.2.1.0 (Tenable; Wiz).
PHP for Windows, builds bundling Brotli 1.0.3 to 1.2.0; fixed in 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1 (Tenable).
Java brotli4j, fixed in 1.24.0 (bundles Brotli 1.2.1) (Aikido).
andybalholm/brotli (Go), affected before v1.2.7; fixed in v1.2.7 (Wiz).

Linux distributions that use the system Brotli library (Debian, Ubuntu, Fedora, RHEL, Alpine, Amazon Linux, SUSE) receive the fix through their own Brotli packages, with coverage varying by distro (Aikido). Tenable also names FFmpeg (via libjxl), Apache Arrow and ClickHouse as affected (Tenable).

What to do

Upgrade and restart. Move Node.js to 22.23.4, 24.22.1 or 26.12.1, and the native Brotli library to 1.0.10, 1.1.1 or 1.2.1; apply the per-project fixes above for Bun, Envoy, Istio, .NET, Python and PHP. Patching takes effect in a process only after restart (Qualys; Tenable).
Rebuild container images. Pinned tags such as node:24.22.0 stay vulnerable; rebuild and redeploy images, single-executable apps and self-contained .NET apps (Aikido; Qualys).
Inventory and prioritise. Check versions with node --version on hosts, CI runners and containers; identify services that decompress Brotli from requests, external responses or uploads, including indirect dependencies, and prioritise internet-facing ones (Aikido; Wiz).
Interim mitigations only. Where you cannot upgrade immediately: reject requests with Content-Encoding: br at a proxy, load balancer or WAF; set body-parser’s inflate option to false (compressed bodies are then rejected with HTTP 415); disable Brotli decoding in HTTP clients; and remove the Brotli/brotlicffi packages from Python environments. These do not cover Brotli responses fetched from hostile servers and are a bridge to patching, not a fix (Akamai; Aikido; Tenable). Imperva and Contrast have added WAF/virtual-patch rules, which the vendors stress do not replace the runtime update (Imperva; Contrast Security).
Monitor. Review WAF, application and network logs from 21 October onward for suspicious Brotli traffic, unexpected crashes during decompression and anomalous process behaviour, though sources caution that decoder errors and crashes are not reliable signs of exploitation (Imperva; Contrast Security; Wiz).

Update, 26 October 2026

OpenAI found the Brotli flaw while AI agents were testing its new sandbox controls, an exercise tied to resuming frontier model training

Sources for this update: indianexpress.com, indianexpress.com, thehindu.com, thehindu.com

“Node2Shell: an out-of-bounds write in Google’s Brotli decoder (CVE-2026-111497) reaches far beyond Node.js”