Node2Shell: Node.js Brotli RCE (CVE-2026-111497), Fixed Versions and How to Check

Node2Shell is the name researchers and social media use for CVE-2026-111497, a flaw in the Brotli decoder inside Node.js. Node.js fixed it on 21 October 2026 in versions 22.23.4, 24.22.1 and 26.12.1. The Node.js advisory rates it high and says it permits remote code execution. The CVE record from Google rates it 9.2 on CVSS 4.0, which is critical. Node.js itself does not use the name. Since late 23 October (UTC) the same flaw is also being called HTTP2Shell. It is one CVE, not a second flaw; see the update below.

This post joins the Node.js advisory, the fix from the Brotli project, the CVE record and the first public statements. It marks what is confirmed and what is only reported. It sits next to our PHP2Shell analysis, because both fixes landed on the same day. It also sits next to the eMudhra CA key compromise, which changed Node.js’s certificate list in the same release.

Last updated: 11 November 2026 (NVD status and score, KEV due date and Debian rows; before that, on 28 October, public exploit labs on GitHub brought up to date and, CISA’s KEV listing, the out-of-band .NET update and Microsoft’s security record). We update this post when Node.js, the Brotli project or national CERTs publish new facts.

What Is Node2Shell?

Brotli is a compression format. Web servers and clients use it to shrink data in transit. The Brotli decoder is the code that unpacks it, and Node.js ships a copy of that code.

The CVE record, written by Google as the CVE numbering authority, describes a buffer overflow in the decoder file c/dec/decode.c. It says a remote attacker with no login can use a crafted Brotli stream. The attacker could corrupt memory next to the decoder state, read sensitive memory, crash the process or possibly run code. The record lists the weakness types out-of-bounds write (CWE-787) and unchecked return value (CWE-252).

The Node.js advisory credits OpenAI Codex Security, with Khai Tran and Sylvie Mayer, for reporting the flaw. It lists the issue as high and says it affects Node.js 26.x, 24.x and 22.x. The release notes list two changes for it: a Brotli code update taken from the upstream project, and a change that exposes a new Brotli decoder error code.

1. 1Crafted Brotli dataThe attacker sends compressed data to an app that decodes it, in a request body or a fetched response
2. 2Decoder reads the streamNode.js unpacks the data with its built-in Brotli decoder
3. 3Out-of-bounds writeBad input makes the decoder write past its buffer and corrupt nearby memory
4. 4ImpactMemory leak, crash or command execution with the permissions of the Node.js process

The steps above restate the CVE record and the Vercel bulletin. Vercel says researchers showed memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. The CVSS 4.0 vector in the CVE record has network access, low complexity and no privileges or user action. It also marks an attack requirement as present, which fits the fact that the app has to decode the attacker’s data.

Node2Shell vs PHP2Shell: How Do They Differ?

PHP2Shell is two flaws in the PHP engine. Node2Shell is one flaw in a Brotli decoder that Node.js bundles. The PHP flaws can be reached by requests to a web server running PHP. The Node.js flaw needs an app or library that decodes attacker-controlled Brotli data, which is common but not universal. The Node.js release came first, at 10:38 UTC on 21 October, and PHP followed later that day. Our PHP2Shell analysis covers the PHP side, and the PHP2Shell timeline of the first 36 hours shows how the public reaction ran.

The name followed the same pattern. In our X capture, the first post using “Node2Shell” is from 21 October at 17:08 UTC. Ron Masas used it in his post a day later. Neither the Node.js advisory nor the CVE record uses it.

Which Node.js Versions Are Fixed?

Node.js published v22.23.4, v24.22.1 and v26.12.1 on 21 October 2026 at 10:38 UTC. The advisory also says: “End-of-Life versions are always affected when a security release occurs.”

The end-of-life dates come from the Node.js release schedule. Vercel says Node.js 20 “will not receive this fix”, and tells projects on it to move to 22.x or 24.x. If you run a version from the last three rows, treat it as affected and plan an upgrade. This is the Node.js rule, not a measurement.

Who Is Really Exposed?

Vercel puts it this way: Node.js does not decode Brotli data on its own. An app is exposed when its code, or a library it uses, decompresses Brotli data that an attacker controls. That can be a request body or a response the app fetches. Three routes matter most, and we checked all three in the public source code.

The first row is the one that worries people. The JSON parser runs for requests with a JSON content type. If such a request also says Content-Encoding: br, the body goes through Node’s Brotli decoder before your route code runs. Ron Masas, a researcher, wrote on X on 22 October that on a vulnerable runtime, “app.use(express.json()) is enough”. He says a single Brotli request then exposes the server to code execution. That matches what the source code does for Express 5.

Open the post on X (@RonMasas, Ron Masas, 22 October 2026, 17:06 UTC).

The second row is a reading of the code, not a promise. Other middleware, frameworks, reverse proxies and your own code may still decode Brotli. Vercel also notes that self-hosted Next.js image optimization does not block Brotli responses. For the Next.js side of this week, see our Next.js and Node.js security updates guide.

Free Node.js Version CheckPaste your Node.js version into Atlas and it says whether that version is vulnerable to CVE-2026-111497. It compares the number with the Node.js advisory and never contacts your server.Check Your Node.js Version Free →

Is Node2Shell Being Exploited?

On 27 October CISA added the CVE to its exploited-vulnerabilities catalog. Three facts are on record; the third is as the researcher stated it on 22 October.

• In the KEV catalog. CISA added the CVE on 27 October, with a due date of 10 November. The file released on 23 October at 19:30 UTC did not list it. The entry does not say who is exploiting the flaw or how.
• CISA’s assessment. The CISA data attached to the CVE record now lists exploitation “active”, automatable “no” and technical impact “total” (entry of 27 October, 19:53 UTC). On 23 October the same data listed exploitation “none”.
• Researchers say they reproduced it. Ron Masas wrote on 22 October that his team reproduced the flaw as pre-authentication RCE. The write-up he links is on Imperva’s site; we cite his public statement.

Aikido’s analysis says researchers reported code execution on the official, unmodified Node.js 24.22.0 image for Linux arm64. It adds that the exploit did not work every time and that 24.22.1 rejects the same input. Aikido presents these as the researchers’ reports, not its own test.

Public proof-of-concept code is on GitHub, covered in the next section. Treat any file, token or “scanner” offered under the Node2Shell name as untrusted until a vendor or a CERT confirms it.

Is There a Public Node2Shell Exploit on GitHub?

Yes. Proof-of-concept code is public, and two repositories now report remote code execution against lab setups. On 22 October at 20:28 UTC, a GitHub search for CVE-2026-111497 returned 11 repositories. On 23 October at 22:00 UTC it returned 25, and on 28 October at 10:00 UTC it returned 71.

The first appeared on 21 October at 15:47 UTC, about five hours after the Node.js fixes shipped. Searching the three nicknames as well gives 94 repositories, five of them older than the flaw. Many are version checkers and host audit scripts. We read descriptions and README files and did not run any of the code.

• Crash on stock Node.js. One lab sends two Brotli chunks over the network to a small service that uses the standard zlib API. Its authors report that the service goes down on Node.js 20.19.5, 22.23.3, 24.22.0 and 26.12.0. In their tests, the fixed 22.23.4, 24.22.1 and 26.12.1 reject the same input. The authors do not claim remote code execution.
• Remote code execution in the same lab. The team’s README now documents a network-only run against an Express 5.3.0 lab on the official Node.js 24.22.0 x86-64 image, recorded on 22 and 23 October. The output of the id command comes back on the same connection. The README calls the result probabilistic and tied to that exact binary, a pinned socket number, a restart supervisor and a memory-layout guess. It says the fixed 24.22.1 rejects the request.
• Code execution in a lab. Another team reports local command execution in three of three runs. It needed a Node.js build that loads an unfixed system Brotli library and a predictable memory layout, set with a Node.js flag or by turning off address randomization. The same team says blind remote code execution with randomization on did not work.
• A second exploit lab. A repository created on 24 October (85 stars on 28 October) has a script that sends a 23 MB request to a Node.js 24.22.0 x86-64 lab. Its README says command output returns over the attacker’s own connection, about one attempt in seven to ten lands, and a miss crashes the worker. It says the addresses are specific to each Node.js build and the patched 24.22.1 container rejects the input.
• A dissenting analysis. One researcher argues that no Brotli stream, valid or malformed, can reach the bad write, so the real impact is a denial of service. That is one analysis, not the view of Node.js or Google, and the labs above report crashes and code execution against the same code.
• Other repositories. One more lab with an Express app claims code execution in its title. The earliest repository says no public exploit exists and offers probes and a resource exhaustion test. The rest are version checkers, audit scripts and mitigation notes.

So public code reportedly crashes unpatched Node.js, and two labs report remote code execution on one exact Node.js 24.22.0 build. Both authors say a run can fail and a miss crashes the worker. A crash alone can take down a service that decodes Brotli from users, so patching does not wait for this dispute.

Run any GitHub proof of concept only in an isolated lab, because exploit code from unknown accounts can hide malware. We do not link these repositories.

How Can You Check Your Exposure?

We know of no safe test for the flaw from Node.js or a CERT, so do not send exploit traffic to a server. Some GitHub scanners send a request of about 23 MB, and the exploit labs report that a miss crashes the worker. Run such tools only against systems you own. You can check versions and code paths safely.

• List every Node.js runtimeInclude containers, CI runners, serverless functions, build servers and tools that ship their own Node.js.
• Read the versionRun node –version inside the real runtime or image. Compare with 22.23.4, 24.22.1 and 26.12.1, or newer.
• Rebuild imagesA base image tag can be old. Pull a patched base image, rebuild and redeploy, then check the version again.
• Find Brotli decoding in your codeSearch for express.json, bodyParser, createBrotliDecompress and fetch calls to servers you do not control.
• Check the Express lineRun npm ls express body-parser. Express 5 uses body-parser 2.x, which decodes Brotli bodies.
• Mark unsupported linesNode.js 20 and older get no fix. Plan an upgrade to 22.x or 24.x.

node --version
npm ls express body-parser
grep -rnE "express\.json|bodyParser|createBrotliDecompress|brotli" src/

Brandefense Atlas has a free Node2Shell checker. Paste the output of node --version or an exact Docker tag, and it says whether that version is vulnerable. It compares the version with the Node.js advisory and never contacts your server.

A moving tag such as node:24 gets no verdict, so read the version inside the image first. For the severity, KEV status and fixed versions, see the Atlas page for CVE-2026-111497.

Distribution packages keep their own version numbers. Read the vendor notice before you decide that a package is safe or not. Teams that lose track of their Node.js services can use External Attack Surface Management to list what faces the internet. That list is a good starting point for the update order.

What Can You Do If You Cannot Update Yet?

Upgrading is the fix. Vercel says to upgrade “regardless of WAF protections”. If you must wait, these steps lower the risk for one route each.

• Turn off body decoding in Express. body-parser’s documentation says that with inflate set to false, compressed bodies are rejected. In its code, any request with a content encoding other than identity gets a 415 error. Set express.json({ inflate: false }) and test your clients, because this also rejects gzip bodies.
• Refuse Brotli request bodies at the edge. A proxy rule that rejects requests with Content-Encoding: br removes the request route. Patch the Planet gives the same advice and says to cover direct-to-origin and alternate routes, so test every route first. It does not touch responses your code fetches.
• Allow only identity, gzip and deflate. Patch the Planet shares an Express guard that runs before every body parser and answers 415 for any other Content-Encoding. It also rejects stacked encodings such as gzip, br. For Next.js, it suggests setting images.unoptimized until Node.js is patched, and notes this does not protect other server-side fetches.
• Do not rely on Accept-Encoding. For fetched responses, Patch the Planet says to reject Brotli before decoding. It notes that removing br from Accept-Encoding alone does not stop a server from sending it.
• Use a WAF as an extra layer. Vercel says its WAF rules are live for every project, at no cost and with no setup, and that they block known exploit patterns. The rules cover traffic through Vercel’s network, not responses your functions fetch from other servers. Vercel also says to restrict direct access to external backends so traffic reaches them only through Vercel.
• Do not trust a missing vendor rule. Ask your WAF provider whether a rule covers this CVE, and do not assume one does. Patch the Planet says request-size limits and WAF rules alone do not cover every decoding path.
• Azure WAF customers. Microsoft’s Azure WAF guidance says rule 920450 in DRS 2.2 blocks the crafted requests it analysed by default. Older rule sets need an upgrade or a custom rule; see HTTP2Shell fixed versions by stack.
• Cloudflare customers. Cloudflare’s emergency WAF release announces two Managed Ruleset rules for this CVE, but their default action is Log, so by default they block nothing. Check the matches and your overrides, then decide on Block; blocking the Next.js image rule may stop images loading.
• Cut what an attacker would gain. Code runs with the permissions of the Node.js process. Run it as an unprivileged user and keep secrets out of its environment where you can.
• Move off Node.js 20. Vercel says its projects on Node.js 20 must switch to 22.x or 24.x and redeploy. Container images you build yourself need a rebuild on a patched base.
• Verify the running build. Patch the Planet advises checking the running binary or image against the vendor’s fixed release. It also says to restart or redeploy every service, worker, scheduled job and replica that uses the old build.

Does the Flaw Reach Beyond Node.js, and What Is HTTP2Shell?

HTTP2Shell is the newer name for the same CVE-2026-111497, used in posts since late 23 October (UTC). Bun’s post on X uses it, while GitHub’s advisory GHSA-9v8h-qqgm-4m35 says the “Node2Shell” flaw in the Brotli decoder also affects the PyPI Brotli package. A third name, Broccoli2Shell, has been used on X since 24 October 2026. A Wiz Research blog post of 25 October 2026 uses it and lists Node2Shell and HTTP2Shell as other names for the same flaw. Wiz says its data show that 91% of cloud environments have resources vulnerable to CVE-2026-111497 and that 82% have publicly exposed Node.js instances. None of the three names is a separate vulnerability, and no official record we read assigns a second CVE. Our HTTP2Shell guide lists fixed versions by runtime and distribution.

The CVE record places the root bug in Google’s Brotli library, versions 1.0.3 through 1.2.0. It tells users to update any Brotli libraries or binaries in that range to 1.0.10, 1.1.1 or 1.2.1. The Brotli project published all three releases on GitHub on 21 October at about 19:27 UTC. Each lists CVE-2026-111497 as a security fix.

Japan’s JPCERT/CC and IPA published advisory JVNVU#97400824 (in Japanese) on 26 October 2026. Its affected versions are Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1 and 1.2.0 before 1.2.1, in line with the CVE record. It advises updating.

• Python: GitHub’s reviewed advisory GHSA-9v8h-qqgm-4m35 (critical, published 22 October at 15:32 UTC) lists the PyPI packages brotli, vulnerable from 1.0.3 before 1.2.1, and brotlicffi, vulnerable from 1.0.3 before 1.2.1.0. The Brotli package on PyPI, whose home page is the Google repository, published version 1.2.1 on 22 October at 13:57 UTC. Aikido says Brotli 1.2.0 and earlier are affected, and so is brotlicffi 1.2.0.x, which is fixed in 1.2.1.0. It says an app can be exposed through a library that decodes Brotli for it, without importing Brotli itself. Aikido notes that the research on the Python packages did not try to reach code execution in the Python extension.
• Bun: its advisory GHSA-663w-cv8g-jj2p says Bun 1.4.3 and earlier bundle an affected Brotli and are fixed in 1.4.4. Its fetch, node:zlib and DecompressionStream APIs pass data to the decoder. A Bun commit merged on 22 October updates Brotli from 1.2.0 to 1.2.1 and says this carries the fix for CVE-2026-111497. Bun 1.4.4, released that day at 10:11 UTC, is the first release that contains it.
• Debian: its security tracker, read on 11 November, lists fixed brotli packages for bookworm (1.0.9-2+deb12u1), trixie (1.1.0-2+deb13u1) and forky and unstable (1.2.0-4.1). It notes that Debian’s nodejs uses the system Brotli library and rates the nodejs entry “unimportant”. It still lists the nodejs packages in bookworm (18.20.4) and trixie (20.19.2) as vulnerable, and shows forky and unstable fixed in nodejs 24.22.2.

We have not tested other products that bundle Brotli. Beyond Python and Bun, we name none as affected. Ask software vendors whether their products include a Brotli build in the affected range. Cisco’s growing product list and the 11 November Node.js release are tracked in our Node.js ecosystem roundup.

What Else Did the Node.js Release Fix?

The same release fixes ten issues, and updates c-ares, OpenSSL, SQLite, Undici and the certificate list for the eMudhra intermediate CA compromise. Besides CVE-2026-111497, Node.js rates three more as high:

• CVE-2026-105482: dns.resolve cuts off names that contain a NUL character. It affects 26.x, 24.x and 22.x.
• CVE-2026-105483: a TLS certificate hostname bypass when an IP address is written with fullwidth digits. It affects 26.x and 24.x.
• CVE-2026-106069: a TLS certificate hostname bypass when the host loosely resolves to an IP address. It affects 26.x, 24.x and 22.x.

The other six are medium or low. Upgrading to the fixed versions covers all ten. For the certificate side, read our eMudhra guide for Python, uv and container teams.

After Node2Shell, a second name followed. Our X capture for “http2shell” holds 32 posts between 23 October at 16:00 UTC and 24 October at 01:30 UTC, 15 of them in the 23:00 UTC hour. Three posts push a crypto token under the same name and the CVE number. Those posts are not part of the flaw or its fix, and we opened none of their links.

What Is the Security Community Saying?

We collected public posts on X from 21 October (11:55 UTC) to 22 October (19:48 UTC) that matched four searches. The searches were “node2shell”, “CVE-2026-111497”, “brotli rce” and “brotli node.js vulnerability”. We read counts and themes only. The capture holds 444 unique posts.

• Volume and timing. The busiest hours were 15:00 UTC on 21 October (26 posts) and 02:00 UTC on 22 October (25 posts). Only 19 of the 444 posts use the word “Node2Shell”.
• Languages. 284 posts are in English (64%), 62 in Japanese (14%) and 27 in Chinese (6%).
• A bad week story. 205 posts (46%) also mention PHP, 113 (25%) mention eMudhra and 89 (20%) mention both. Most treat Node.js as one item in a list of the week’s incidents.
• Patch talk. 192 posts (43%) talk about patching or fixed versions, and 25 (6%) about mitigations.
• Vendor and researcher voices. Vercel’s developer account posted on 21 October at 23:24 UTC that its WAF rules are live. Ron Masas posted on 22 October at 17:06 UTC. Links to nodejs.org appear in 87 posts.

Since that capture, the Czech government CERT GovCERT.CZ posted a warning on X on 23 October at 13:26 UTC. It tells teams to fix first the apps that pass untrusted Brotli data to node:zlib or fetch(). It also tells teams on Node.js 20 and older to move to a supported line.

Our keyword filter marked 46 posts as exploit claims, 11 as proof of concept, 11 as scanning, 14 as possible sales and 15 as possible scam tokens. The filter is crude. In a sample of the sale and scam-token flags, most were roundup posts about the week’s incidents, not exploit offers. We opened none of the links in these posts and we link none here.

Read the numbers as a view of one platform, not of all researchers. The practical warning stands: during a loud week, fake exploit tools, “checkers” and tokens appear. Take fixes and advice only from Node.js, your vendors and your national CERT.

What Happened When?

1. 21 Oct 2026, 10:38 UTCNode.js ships the fixesGitHub shows v22.23.4, v24.22.1 and v26.12.1 published at this time. The advisory page is dated 21 October.
2. 21 Oct 2026, 17:08 UTCThe name appearsThe first post using “Node2Shell” in our X capture.
3. 21 Oct 2026, about 19:27 UTCBrotli project releasesBrotli 1.0.10, 1.1.1 and 1.2.1 appear on GitHub, each listing CVE-2026-111497 as a security fix.
4. 21 Oct 2026, 23:24 UTCVercel announces WAF rulesVercel’s developer account says its WAF rules are live. Vercel’s bulletin is dated 21 October.
5. 22 Oct 2026, 10:11 UTCBun 1.4.4Bun releases a version whose Brotli is updated to 1.2.1, the version with the fix.
6. 22 Oct 2026, 13:35 UTCCVE record publishedGoogle’s CVE record lists a 9.2 score on CVSS 4.0 and the affected Brotli range.
7. 22 Oct 2026, 13:57 UTCPyPI Brotli 1.2.1The Python Brotli package gets version 1.2.1.
8. 22 Oct 2026, 14:15 UTCCISA adds data to the recordCISA lists exploitation “none”, automatable “no” and technical impact “total”.
9. 22 Oct 2026, 14:17 UTCNVD record appearsNVD lists the CVE as awaiting analysis.
10. 22 Oct 2026, 17:06 UTCResearcher statementRon Masas says his team reproduced the flaw as pre-authentication RCE.
11. 23 Oct 2026, 09:31 UTCBun publishes its advisoryGHSA-663w-cv8g-jj2p says Bun 1.4.3 and earlier bundle an affected Brotli and Bun 1.4.4 fixes it.
12. 23 Oct 2026, 13:26 UTCCzech CERT warningGovCERT.CZ posts a warning on X and urges patching Node.js.
13. 23 Oct 2026, 19:08 UTCGitHub reviews its advisoryGHSA-9v8h-qqgm-4m35, rated critical, lists the PyPI packages brotli and brotlicffi with fixes in 1.2.1 and 1.2.1.0.
14. 23 Oct 2026, 20:45 UTCPython warningAikido posts on X that the Python Brotli package is affected. Fixed versions are Brotli 1.2.1 and brotlicffi 1.2.1.0.

For the weakness in plain terms, see our glossary entry on remote code execution, and the CVE-2026-111497 vulnerability page for the short fact sheet. Teams that need to rank this against the rest of the week can use vulnerability intelligence to decide what to patch first.