Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

TL;DR

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.

Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

The fix: upgrade to the patched Node.js version for your release line

• 22.x -> 22.23.4
• 24.x -> 24.22.1
• 26.x -> 26.12.1

For Bun, upgrade to 1.4.4 or newer.

How Aikido helps: Aikido detects the vulnerability and shows you which repositories and container images still run a vulnerable version.

Who is affected by CVE-2026-111497?

If you run Node.js, assume you are affected until you have checked your version. Every supported release line had the flaw before the October 21 update, and Bun had it too until version 1.4.4.

How exposed you are depends on where your app gets its compressed data. Brotli is a compression format that servers and clients use to shrink web traffic, and the vulnerability can be triggered when Node.js decompresses Brotli data that an attacker controls. That can happen in at least three ways:

• Servers that accept requests: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, and any client can send one. A bare Node.js HTTP server does not decode incoming Brotli bodies on its own.
• Apps that call other servers: fetch() decompresses Brotli responses automatically, so a server an attacker controls or has compromised can reach your app through its response. Webhooks and other features that call user-supplied URLs are the typical targets.
• Code that uses node:zlib directly: any untrusted input passed to its Brotli functions. Many more server frameworks that applications are based on will do this for you.

How to fix CVE-2026-111497

The fix is a Node.js upgrade, and it takes four steps:

1. Check your version with node --version on laptops, CI runners, servers and inside containers.
2. Upgrade to 22.23.4, 24.22.1 or 26.12.1, or to a newer patch release of the same line.
3. Rebuild and redeploy your container images. An image pinned to an earlier tag, such as node:22.23.3-alpine, stays vulnerable until you rebuild it on a patched version.
4. Plan a move off Node.js 25.x, 23.x, 20.x and earlier. Those lines are end of life and will not get this fix.

Managed platforms that bundle their own Node.js runtime can lag behind the upstream release, so check which version your provider runs. If you cannot upgrade today, read the stopgaps below. Bun users should upgrade to Bun 1.4.4 or newer, which includes the fix. The Bun team tracked it in oven-sh/bun issue 46352.

If your Node.js came from a Linux distribution package such as Debian, Ubuntu, Fedora, RHEL, or Alpine, it may use the system Brotli library instead of the copy Node.js bundles. In that case, the fix arrives through your distribution's Brotli package, so check your distribution's security advisory as well as the version number.

How Aikido helps with CVE-2026-111497

Aikido detects this vulnerability and flags the affected Node.js versions in your repositories and container images. Your dashboard shows which services still run a vulnerable runtime, so you can upgrade the ones that call outside servers or accept compressed request bodies first. Once you have upgraded, a fresh Aikido check confirms the finding is gone.

Node2Shell technical details

What is Node2Shell (CVE-2026-111497)?

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. In plain terms, the decoder can be tricked into writing data past the end of a memory buffer, which is a classic route to crashes and code execution. Node.js rates it high and describes the impact as remote code execution.

Brotli is Google's compression library, and Node.js ships its own copy. The flaw sits in that bundled code, so fixing it means updating the Node.js runtime itself. Node.js runs the decoder whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when fetch() receives a response sent with Brotli compression.

The fix is an upstream patch from the Brotli project, which Node.js cherry-picked (Brotli commit 0ed4268a from February). It makes the decoder detect invalid input and stop before it writes past the buffer. The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may need an update too.

How serious is CVE-2026-111497, and is it being exploited?

Node.js rates the flaw as high severity, one step below critical, and the public research has moved fast. A first proof of concept, published on October 22, reached code execution only against a deliberately weakened test build. The same day, security researchers reported code execution against the official, unmodified Node.js 24.22.0 image on Linux arm64, although their exploit did not work on every attempt, and Node.js 24.22.1 rejects the same input. According to The Hacker News, no exploitation in the wild had been reported as of October 22.

Treat it as urgent anyway. The bug is a memory-safety flaw in a runtime component that handles untrusted network input, public proofs of concept exist, and the fix is a routine version bump. Services that call outside servers or accept compressed request bodies should go first.

How to check if your app is exposed

1. List every Node.js version you run: node --version on hosts and CI runners, and docker run --rm <image> node --version for each container image. A package inventory can miss a runtime that is bundled inside an image.
2. Find where Brotli data enters. Run npm ls express body-parser to spot Express 5 and body-parser 2.x, and search your code (and dependencies) for brotliDecompress and createBrotliDecompress from node:zlib.
3. List the outbound fetch() calls that go to servers you do not control, including webhook deliveries and user-supplied URLs.
4. Upgrade the services that match steps 2 or 3 first, then the rest.

A Dockerfile pinned to node:24.22.0 stays vulnerable no matter how often you rebuild it. Move the pin to 24.22.1 or later.

What to do if you cannot upgrade yet

The Node.js advisory offers no workaround for the Brotli flaw. These stopgaps reduce exposure while you prepare the upgrade:

• Reject Brotli-encoded requests: drop incoming requests with Content-Encoding: br at your reverse proxy, load balancer or application middleware. Aikido used this stopgap on internal services that could not be upgraded right away.
• Use edge rules where your platform offers them: Vercel added firewall rules on October 21 that block the attack in inbound requests.

Neither stopgap covers Brotli responses that your application fetches from other servers. Only a runtime upgrade removes the flaw, so treat stopgaps as a bridge to it.

Node2Shell timeline

• February 2026: The fix is first committed to the Brotli source code.
• October 21, 2026: Node.js releases 22.23.4, 24.22.1 and 26.12.1. Brotli ships the same fix in 1.2.1, 1.1.1 and 1.0.10, and Vercel adds firewall rules for inbound requests.
• October 22, 2026: A public proof of concept appears, and researchers report code execution on an unmodified Node.js 24.22.0 build.

FAQ

What is Node2Shell?

Node2Shell is the name circulating online for CVE-2026-111497, the Brotli decoder flaw in Node.js that the Node.js project says can allow remote code execution.

Which Node.js versions fix CVE-2026-111497?

Node.js 22.23.4, 24.22.1 and 26.12.1, plus any newer patch release of those lines. Node.js 25.x, 23.x, 20.x and earlier are end of life and get no fix.

Is CVE-2026-111497 being exploited?

No exploitation in the wild had been reported as of October 22, 2026. Researchers have reported code execution on an unmodified Node.js 24.22.0 build in lab conditions, and the exploit did not work on every attempt.

Does body-parser or express.json() make my server vulnerable?

Yes, if your parser decompresses Brotli request bodies. Express 5 and body-parser 2.x do, so a client can send a crafted Content-Encoding: br request. Upgrading Node.js is the fix.

Is there a workaround?

The Node.js advisory lists none. Rejecting Brotli-encoded requests at the edge reduces inbound exposure, but it does not protect against Brotli responses your app fetches.

Is Bun affected?

Yes, versions before 1.4.4 are affected. Bun 1.4.4 includes the fix, and the Bun team tracked it in oven-sh/bun issue 46352.