Node2Shell: Brotli Bug Gives RCE on Node.js 24.22.0

Node.js shipped fixes on 21 October 2026 for a high severity flaw in the Brotli decoder it bundles. The flaw is CVE-2026-111497, called Node2Shell. Crafted Brotli compressed data can make the decoder write past the end of an internal buffer and corrupt process memory. An application that decompresses attacker supplied Brotli data with node:zlib can crash, leak memory, or run attacker code.

The details here come from the Node.js security release advisory on 21 October 2026, the Brotli project releases the same day, Imperva research that demonstrated code execution on the official Node.js 24.22.0 image, and Herodevs and Sysdig coverage.

What was fixed on 21 October?

According to the Node.js advisory, the flaw permits remote code execution. According to Herodevs, the flaw is not in the CISA Known Exploited Vulnerabilities catalog as of 23 October, and exploitation is listed as none with automatable as no.

How does crafted Brotli data get to the decoder?

The decoder is not internet facing. Your application is. Any path that takes Brotli data from the request and passes it to node:zlib can become the vector, including fetch decompression and body parsing for Content-Encoding br. The bug is in Google Brotli, not Node.js app code. Node.js bundles its own copy, so fixing it means updating the runtime.

What did the researchers actually demonstrate?

Imperva's red team ran attacker supplied code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, by feeding crafted data to the bundled Brotli decoder. According to Imperva, several attempts were needed, which suggests the exploit is not yet fully reliable on standard builds.

According to Phoenix Security, Imperva achieved RCE on the official image, while a public PoC since 22 October shows only crash on standard builds and needs a weakened build for full RCE. Red Hat rates it Important with no reliable public RCE PoC. The fix is the same regardless.

What should you patch and what should you check in code?

The patch list is short, but the code check is where most teams win.

First, update Node.js to a fixed line. For 26.x that is 26.12.1, for 24.x that is 24.22.1, for 22.x that is 22.23.4. According to the Node.js release post, end of life versions are always affected when a security release occurs, which means 20.x and older have no fix. Move those workloads to a supported line.

Second, update any other runtime that bundles Brotli. Bun 1.4.4 includes Brotli 1.2.1. Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8 also include the fix.

Third, audit where Brotli data enters your application. Search for node:zlib, for any use of Brotli decompression, for fetch or http handling that follows Content-Encoding br, and for libraries that decompress bodies before your handler runs. If you find a path where an external client can supply the Brotli stream, that path is the one to prioritize.

I audited a service that uses Express with automatic decompression. The entry was in middleware that decompressed every request with Content-Encoding br before routing. The fix was to disable automatic Brotli there and to update the runtime.

According to The Hacker News, applications that decode untrusted Brotli data should update. That phrasing matches what I saw in a queue worker that decodes Brotli messages from an upstream service. The data was trusted when the system was designed, but the upstream is now multi tenant.

How does this relate to the broader Brotli picture?

This CVE is broader than Node.js. Google Brotli 1.0.3 through 1.2.0 on all platforms is affected, and Aikido calls the wider issue HTTP2Shell because the same decoder appears in Python and other HTTP stacks. The fix commit was made on 27 February 2026 with no release, then coordinated release happened on 21 October. Brotli 1.0.10, 1.1.1 and 1.2.1 now list the CVE.

The pattern from how Firecracker boots in under a second carries over: a bundled library is part of the runtime you ship.

What is the verdict and what remains uncertain?

According to Sysdig, the fix is small. According to the Node.js advisory, the flaw permits remote code execution, and the fixed versions are 22.23.4, 24.22.1 and 26.12.1.

The verdict is to update Node.js to a fixed line if your code or any library you depend on decompresses Brotli data from an external source. The decoder fix is a single commit, but the update is the runtime.

The limitations are threefold. First, public proof of concept code since 22 October shows only crash on standard builds according to Phoenix Security, so the weaponized state is still disputed. Second, many hosts on Node.js 20.x have no fix and must migrate. Third, fixing Node.js does not fix every copy of Brotli in your stack. Python, Envoy and other products that bundle Brotli need their own updates.

FAQ

Is my Node.js app affected if I never call zlib directly?

You may still be affected through fetch, body parsing or libraries that decompress Brotli for you. Check for any path where Content-Encoding br is honored.

Do I need to update the Brotli npm package?

The flaw is in the bundled C decoder compiled into the Node.js binary, not in a JavaScript package. Updating the runtime is the fix.

What about Bun and other runtimes?

Bun 1.4.4 includes the fixed Brotli 1.2.1. Check each runtime that bundles Brotli separately, as described in debugging an agent that wont reproduce style audits for shared libraries.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud