The Node.js advisory rates it high and says it permits remote code execution. Google's CVE record scores it 9.2 on CVSS 4.0. It is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in Brotli 1.0.10, 1.1.1 and 1.2.1.
What it allows
The CVE record says a remote attacker with no login can use a crafted Brotli stream to corrupt memory next to the decoder state. The record adds that this can leak sensitive memory, crash the process or possibly run code. Vercel says researchers showed memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x, and that the code runs with the permissions of that process.
The app has to decode Brotli data the attacker controls. Vercel names request bodies and fetched responses. In body-parser 2.x, used by Express 5, express.json() decodes Brotli request bodies by default.
CISA added this CVE to its Known Exploited Vulnerabilities catalog on 27 October 2026, with a due date of 10 November and known ransomware campaign use listed as "Unknown". The entry does not say who is exploiting it or how. Read our Node2Shell analysis for the fixed versions and checks.
Who is affected
The Node.js advisory lists Node.js 26.x, 24.x and 22.x as affected and says end-of-life versions are always affected. The fixed versions are 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026. Node.js 20 reached end of life on 30 April 2026, and Vercel says it will not receive the fix. External attack surface management lists your internet-facing services, so you know which Node.js servers to check first.
The CVE record places the root bug in Google Brotli 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. GitHub's advisory GHSA-9v8h-qqgm-4m35 (critical) lists the PyPI packages brotli, fixed in 1.2.1, and brotlicffi, fixed in 1.2.1.0.
Bun's advisory says Bun 1.4.3 and earlier bundle an affected Brotli and are fixed in Bun 1.4.4.
Fixed versions by runtime and Linux distribution are in our HTTP2Shell fixed-versions table. Other software that bundles Brotli in that range may be in scope. Debian's tracker, read on 11 November, lists fixed brotli packages for bookworm (1.0.9-2+deb12u1, DLA-4855-1), trixie (1.1.0-2+deb13u1, DSA-6582-1) and forky and unstable (1.2.0-4.1).
The Patch the Planet page from OpenAI names Node.js, Bun and deployments of Envoy Proxy or Istio configured for Brotli decompression as affected. Its fixed releases include Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio 1.31.2, 1.30.6 and 1.29.9. It says Istio 1.29 is end of life.
Microsoft's .NET advisory of 25 October 2026 lists runtimes 8.0.33, 9.0.22 and 10.0.14 as fixed, and .NET 11 Release Candidate 3 (11.0.0-rc.3.26522.148). Microsoft released them as an out-of-band update; our .NET update playbook for self-contained, NativeAOT and container apps has the steps. The PHP brotli extension 0.21.1 and UEFITool A76 list Brotli 1.2.1 in their release notes.
PHP announced Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on 26 October 2026, each with Brotli 1.2.1. In those builds the decoder can be reached through the cURL extension when automatic response decompression is on, which is off by default.
Microsoft's Security Update Guide entry of 25 October 2026 lists fixes for .NET 8.0, 9.0, 10.0 and 11.0 (release candidate). It also lists Visual Studio 2019, 2022 and 2026, and PowerShell 7.4.22, 7.5.13 and 7.6.9.
To check a runtime, paste its Node.js version or an exact Docker tag into the free Atlas Node2Shell checker. It compares the version with the Node.js advisory and never contacts your server.
Timeline
- 21 Oct 2026
Node.js releases v22.23.4, v24.22.1 and v26.12.1 and publishes its advisory, which rates CVE-2026-111497 high.
- 21 Oct 2026
The Brotli project publishes releases 1.0.10, 1.1.1 and 1.2.1, each listing the CVE as a security fix. Vercel publishes a bulletin and says its WAF rules are live.
- 22 Oct 2026
Google's CVE record is published with a 9.2 score on CVSS 4.0, and the Python Brotli package gets version 1.2.1. CISA data attached to the record lists exploitation as none.
- 22 Oct 2026
Researcher Ron Masas says his team reproduced the flaw as pre-authentication remote code execution on a vulnerable runtime. The CVE is not in the CISA exploited-vulnerabilities file as of 19:57 UTC.
- 23 Oct 2026
GovCERT.CZ warns about the flaw, and Aikido says the Python Brotli and brotlicffi packages are affected.
- 24 Oct 2026
Bun's post on X about its advisories calls the Brotli decoder bug HTTP2Shell.
- 27 Oct 2026
CISA adds the CVE to its Known Exploited Vulnerabilities catalog with a due date of 10 November. It lists known ransomware campaign use as "Unknown".
- 27 Oct 2026
CISA updates the data attached to the CVE record. It now lists exploitation as "active".
What to do
-
Update Node.js
Install 22.23.4, 24.22.1 or 26.12.1, or newer. Rebuild container images on a patched base and redeploy. Upgrade Node.js 20 and older to a supported line.
-
Find every Node.js runtime
List servers, containers, CI runners and serverless functions, and read the version inside the runtime that serves traffic with node --version.
-
Find Brotli decoding in your code
Run npm ls express body-parser. Express 5 uses body-parser 2.x, which decodes Brotli bodies. Search your code for express.json, createBrotliDecompress and fetch calls to servers you do not control.
-
Reduce exposure if you cannot update
Set express.json({ inflate: false }) so compressed bodies are rejected with a 415 error. Patch the Planet advises rejecting Content-Encoding br before any proxy, middleware or body parser decompresses it, and disabling Brotli decoding of untrusted data. A WAF is an extra layer, not a fix.
-
Watch for abuse
Look for Node.js processes that start shells or download tools, and for unusual requests with Content-Encoding br.
What Brandefense can do
- Check CVE-2026-111497 in Brandefense Atlas, free
See the current status of CVE-2026-111497 in Brandefense Atlas, with the sources behind it.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-111497?
It is an out-of-bounds write in the Brotli decoder bundled with Node.js, called Node2Shell by researchers and also HTTP2Shell or Broccoli2Shell in later posts, including Wiz Research's. The Node.js advisory rates it high and says it permits remote code execution.
Which versions fix CVE-2026-111497?
Node.js 22.23.4, 24.22.1 and 26.12.1, and Brotli 1.0.10, 1.1.1 and 1.2.1. Node.js 20 and older get no fix.
Is CVE-2026-111497 exploited?
CISA lists it as exploited: on 27 October 2026 it added the CVE to its Known Exploited Vulnerabilities catalog, due 10 November, without saying who is exploiting it or how. A researcher says his team reproduced pre-authentication remote code execution, and Aikido reports that researchers ran code on the official Node.js 24.22.0 image, though not on every attempt. See the Node2Shell analysis for the full status.
How does it differ from PHP2Shell?
PHP2Shell is two flaws in the PHP engine. CVE-2026-111497 is one flaw in a decoder that Node.js bundles, and an app must decode attacker-controlled Brotli data to be exposed. Read the PHP2Shell analysis for the PHP side.
Is HTTP2Shell or Broccoli2Shell a different flaw from Node2Shell?
No. All three names point to CVE-2026-111497. Wiz Research's post of 25 October 2026 uses Broccoli2Shell and lists Node2Shell and HTTP2Shell as the same flaw. Bun's post on X of 24 October calls the Brotli decoder bug HTTP2Shell, and GitHub's advisory GHSA-9v8h-qqgm-4m35 calls it Node2Shell. The fixes are the same: Brotli 1.0.10, 1.1.1 or 1.2.1, and the fixed Node.js, Python and Bun versions above.
Sources
- Wednesday, October 21, 2026 Security ReleasesNode.js
- CVE-2026-111497 recordCVE Program (Google)
- Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder VulnerabilityWiz
- Brotli release v1.2.1GitHub (Google Brotli)
- Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)Vercel
- Known Exploited Vulnerabilities catalog: CVE-2026-111497 (added 27 October 2026)CISA
- GHSA-9v8h-qqgm-4m35: Brotli decoder out-of-bounds writeGitHub Advisory Database
- GHSA-663w-cv8g-jj2p: bundled brotli decoder out-of-bounds writeBun (GitHub)
