Node2Shell: the Brotli decoder flaw CVE-2026-111497

Most memory-safety bugs belong to one product. CVE-2026-111497 sits in Google's Brotli decoder, a compression library that Node.js, .NET and Python packages ship inside themselves, so one flaw became separate fixes across several runtimes. The trigger is data rather than a special endpoint: a crafted Brotli stream that something in your stack decompresses, including features that decompress without being asked.

Fixes landed on 21 October 2026, when Google tagged Brotli 1.2.1 and Node.js shipped releases for all three of its supported lines. Node credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with the report. NVD published the CVE record and GitHub an advisory for the Python packages on 22 October, and Microsoft published its .NET advisory on 25 October. On 27 October, CISA added it to the Known Exploited Vulnerabilities catalog.

Who is affected

A system is exposed only when it decompresses Brotli data an attacker can influence. Node's advisory names node:zlib and stops there. Two further Node.js paths are visible in library code and documentation:

• fetch(). Node's built-in fetch() comes from undici, whose source decodes br response bodies with zlib.createBrotliDecompress. A malicious or compromised server you fetch from can feed the decoder.
• Express 5. Express 5.3.0 depends on body-parser 2.x. body-parser added Brotli in 2.0.0, and its README says every parser inflates gzip, br, deflate and zstd bodies, with inflate on by default. Any Express 5 route with a body parser mounted decodes Content-Encoding: br requests.

On .NET, Microsoft lists BrotliStream, BrotliDecoder, HttpClient automatic decompression that includes Brotli, and ASP.NET Core request decompression with br enabled. It notes these are not on by default. .NET Framework is not affected.

How Node2Shell works

The decoder bug

Node's advisory gives the clearest account. When a stream contained an invalid block switch, the decoder reported that it needed more input instead of reporting a permanent format error. The streaming decoder therefore kept accepting bytes and appended them to an eight-byte internal buffer, writing past its end.

Google's CVE record classifies the flaw as CWE-787, an out-of-bounds write, and CWE-252, an unchecked return value. The outcome is memory corruption inside the process: a crash, disclosure of process memory, or code execution.

Preconditions and scores

An attacker has to get Brotli data into a decompression path; no account and no user interaction are needed. The scorers differ on difficulty. Google's CVSS 4.0 score of 9.2 records that attack requirements are present, and Microsoft's CVSS 3.1 score of 8.1 rates attack complexity high. Node.js rates the bug high.

Is it being exploited?

Yes, according to CISA, though the public detail is thin:

• CISA. It added CVE-2026-111497 to the KEV catalog on 27 October 2026 as the "Google Brotli Unchecked Return Value Vulnerability", with a federal due date of 10 November. Its assessment on the CVE record changed the same day to active exploitation, not automatable, with total technical impact.
• What is not public. As of 28 October, no vendor or responder has said who exploited it, against which software, or with which indicators.
• Before the listing. Aikido reported no exploitation in the wild as of 22 October, and that researchers reached code execution in a lab against an unmodified Node.js 24.22.0 build on Linux arm64, though not on every attempt. Microsoft's vector rated exploit maturity as unproven when it was published.

The name is a separate question. The GitHub Advisory Database uses "Node2Shell" in its title and Aikido calls it the name circulating online, but neither says where it came from.

Check your exposure

Check every runtime that might decompress untrusted data, on hosts and inside images:

node -v                         # fixed: 22.23.4, 24.22.1, 26.12.1
npm ls body-parser express      # body-parser 2.x inflates br bodies by default
dotnet --list-runtimes          # fixed: 8.0.33, 9.0.22, 10.0.14
pip show brotli brotlicffi      # fixed: 1.2.1 and 1.2.1.0

Run them inside each image you deploy as well as on hosts, because a container carries its own runtime. Other software can bundle its own copy of Brotli; check those vendors' advisories for 1.0.10, 1.1.1 or 1.2.1.

Fix it

• Node.js. Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node says end-of-life versions are always affected by a security release, so move off them.
• .NET. Install runtime 8.0.33, 9.0.22 or 10.0.14, or the matching SDK. NativeAOT applications link the decoder into the executable and must be republished.
• Python. Upgrade brotli to 1.2.1 or brotlicffi to 1.2.1.0.
• Containers. Rebuild images; restarting a container does not change its runtime.

Until you can upgrade, the only vendor interim guidance is Microsoft's for .NET: remove br from existing ASP.NET Core decompression providers, and change existing HttpClient automatic decompression flags to exclude Brotli. Microsoft warns against adding these settings where an application does not already use them.

Two other stopgaps are in circulation. Neither is vendor guidance for this CVE:

• body-parser inflate: false. The README documents that it makes parsers reject compressed bodies. It rejects gzip and deflate too, so clients that compress requests will break.
• Rejecting Content-Encoding: br at the edge. Aikido suggests doing this at a reverse proxy, load balancer or middleware.

Neither covers Brotli responses your services fetch from elsewhere. Node.js lists no workaround.

Detect attempts and compromise

No vendor has published indicators or signatures for this bug. Two signals follow from what the advisories describe:

• Crashes. Node.js, .NET or Python processes dying with memory faults while handling compressed input. A crash is one of the outcomes Node lists.
• Unexpected Brotli bodies. Inbound requests with Content-Encoding: br to services whose clients never send it.

If you suspect a successful attempt, treat the host as compromised and rotate secrets the process held in memory, since the bug can also disclose memory contents.

Beyond this patch

Compression libraries often ship as native code inside a runtime, where package managers do not list them. Keep an inventory that reaches that layer, and know where your stack decompresses data on its own: automatic decoding is what turns a library bug into a remote one.