Log in Request a demo

Vulnerability

Node.js Brotli decoder remote code execution (CVE-2026-111497)

CVE-2026-111497, called Node2Shell by researchers, is an out-of-bounds write in the Brotli decoder bundled with Node.js.

CVE ID
CVE-2026-111497
CVSS
9.2 Critical (CVSS v4.0, Google CNA); Node.js rates it high
Affected product
Node.js 22.x, 24.x, 26.x; Google Brotli 1.0.3 to 1.2.0
Exploited
Unknown
Published
21 October 2026 (Node.js fix); 22 October 2026 (CVE record)

In short

CVE-2026-111497, called Node2Shell by researchers, is an out-of-bounds write in the Brotli decoder bundled with Node.js. The Node.js advisory rates it high and says it permits remote code execution. Google's CVE record scores it 9.2 on CVSS 4.0. It is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in Brotli 1.0.10, 1.1.1 and 1.2.1.

Profile MapVulnerability
  1. CVECVE-2026-111497
  2. ProductNode.js project; Google (Brotli) Node.js 22.x, 24.x, 26.x; Google Brotli 1.0.3 to 1.2.0
  3. Fix Steps5actions listedUpdate Node.js · Find every Node.js runtime

What it allows

The CVE record says a remote attacker with no login can use a crafted Brotli stream to corrupt memory next to the decoder state. The record adds that this can leak sensitive memory, crash the process or possibly run code. Vercel says researchers showed memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x, and that the code runs with the permissions of that process.

The app has to decode Brotli data the attacker controls. Vercel names request bodies and fetched responses. In body-parser 2.x, used by Express 5, express.json() decodes Brotli request bodies by default. Read our Node2Shell analysis for the fixed versions and checks.

Who is affected

The Node.js advisory lists Node.js 26.x, 24.x and 22.x as affected and says end-of-life versions are always affected. The fixed versions are 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026. Node.js 20 reached end of life on 30 April 2026, and Vercel says it will not receive the fix.

The CVE record places the root bug in Google Brotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. Other software that bundles Brotli in that range may be in scope. Debian's tracker lists its brotli packages as vulnerable with no fixed version on 22 October.

Timeline

  1. 21 Oct 2026

    Node.js releases v22.23.4, v24.22.1 and v26.12.1 and publishes its advisory, which rates CVE-2026-111497 high.

  2. 21 Oct 2026

    The Brotli project publishes releases 1.0.10, 1.1.1 and 1.2.1, each listing the CVE as a security fix. Vercel publishes a bulletin and says its WAF rules are live.

  3. 22 Oct 2026

    Google's CVE record is published with a 9.2 score on CVSS 4.0, and the Python Brotli package gets version 1.2.1. CISA data attached to the record lists exploitation as none.

  4. 22 Oct 2026

    Researcher Ron Masas says his team reproduced the flaw as pre-authentication remote code execution on a vulnerable runtime. The CVE is not in the CISA exploited-vulnerabilities file as of 19:57 UTC.

What to do

  1. Update Node.js

    Install 22.23.4, 24.22.1 or 26.12.1, or newer. Rebuild container images on a patched base and redeploy. Upgrade Node.js 20 and older to a supported line.

  2. Find every Node.js runtime

    List servers, containers, CI runners and serverless functions, and read the version inside the runtime that serves traffic with node --version.

  3. Find Brotli decoding in your code

    Run npm ls express body-parser. Express 5 uses body-parser 2.x, which decodes Brotli bodies. Search your code for express.json, createBrotliDecompress and fetch calls to servers you do not control.

  4. Reduce exposure if you cannot update

    Set express.json({ inflate: false }) so compressed bodies are rejected with a 415 error. Consider refusing Content-Encoding br at your proxy; this is our suggestion, not vendor advice. A WAF is an extra layer, not a fix.

  5. Watch for abuse

    Look for Node.js processes that start shells or download tools, and for unusual requests with Content-Encoding br. We found no published indicators of compromise in the sources we opened.

Questions

What is CVE-2026-111497?

It is an out-of-bounds write in the Brotli decoder bundled with Node.js, called Node2Shell by researchers. The Node.js advisory rates it high and says it permits remote code execution.

Which versions fix CVE-2026-111497?

Node.js 22.23.4, 24.22.1 and 26.12.1, and Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js 20 and older get no fix.

Is CVE-2026-111497 exploited?

We found no confirmed report of attacks as of 22 October 2026, 19:57 UTC, and the CISA exploited-vulnerabilities file does not list it. A researcher says his team reproduced pre-authentication remote code execution. See the Node2Shell analysis for the full status.

How does it differ from PHP2Shell?

PHP2Shell is two flaws in the PHP engine. CVE-2026-111497 is one flaw in a decoder that Node.js bundles, and an app must decode attacker-controlled Brotli data to be exposed. Read the PHP2Shell analysis for the PHP side.

In our research

  1. Node2Shell: Node.js Brotli RCE (CVE-2026-111497), Fixed Versions and How to Check October 2026
  2. eMudhra CA Key Compromise: What Python, uv and Container Teams Must Update Now October 2026
  3. Next.js and Node.js Security Updates, October 2026: What to Patch First October 2026
  4. PHP2Shell: Two Critical PHP Flaws Reported as RCE, CVE-2026-109618 and CVE-2026-109619 October 2026
  5. Brotli Glossary term
  6. Remote code execution (RCE) Glossary term

Sources

  1. Wednesday, October 21, 2026 Security Releases Node.js
  2. CVE-2026-111497 record CVE Program (Google)
  3. CVE-2026-111497 NVD
  4. Brotli release v1.2.1 GitHub (Google Brotli)
  5. Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) Vercel
  6. Node.js v24.22.1 release notes Node.js
  7. Security tracker, CVE-2026-111497 Debian

Last updated 22 October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Brotli

Brotli is a lossless compression format that makes data smaller so it can be stored or sent faster.

Read more

Glossary term

Remote code execution (RCE)

Remote code execution (RCE) is when an attacker runs code of their choice on another person's system from a distance.

Read more