A single out-of-bounds write in Google’s Brotli decoder has snowballed into one of 2026’s most far-reaching vulnerabilities. Tracked as CVE-2026-111497 and known variously as Node2Shell, HTTP2Shell, and Broccoli2Shell, the flaw affects not just Node.js but every major language runtime and web framework that decompresses Brotli-encoded data — and as of October 27, CISA confirms it is being exploited in the wild.
What Happened
The vulnerability lives in the reference C implementation of Google’s Brotli compression library, specifically in the c/dec/decode.c file. Versions 1.0.3 through 1.2.0 are affected. The root cause is a subtle flaw in how the decoder handles block-type switching: the DecodeBlockTypeAndLength() function returned a boolean value, making it impossible for callers to distinguish between malformed input and a legitimate request for more bytes. A fast-path code section compounded the problem by dropping the return value entirely.
The result is that a carefully crafted Brotli stream can trick the decoder into writing attacker-controlled bytes past the boundaries of an eight-byte internal buffer, overwriting adjacent decoder state on the heap. Depending on memory layout, this can cause anything from a crash to full remote code execution.
What makes this especially dangerous is the sheer ubiquity of Brotli. Originally developed by Google for web content compression, the library has been adopted across virtually every modern web stack. Any application that decompresses attacker-supplied Brotli data — whether from an HTTP response, a file upload, or an embedded format like WOFF2 fonts or JPEG XL images — is potentially in the blast radius.
A Patch That Sat in Plain Sight
One of the more troubling aspects of CVE-2026-111497 is its disclosure timeline. The fix was quietly committed to the google/brotli repository on February 27, 2026 — eight months before the vulnerability was publicly disclosed. During that entire window, the patch was publicly readable on GitHub, effectively serving as a roadmap for anyone looking to develop an exploit.
Node.js broke the silence on October 21, publicly disclosing the flaw alongside patches for versions 22.23.4, 24.22.1, and 26.12.1. Patched Brotli library versions (1.2.1, 1.1.1, and 1.0.10) followed shortly after. End-of-life Node.js versions 18, 20, 23, and 25 remain unpatched and will not receive fixes.
By October 27, threat intelligence firm ELLIO reported exploit traffic targeting the vulnerability in the wild, originating from IP address 94.154.43.7 — an address previously linked to PHP2Shell exploitation, Palo Alto GlobalProtect probing, FortiOS SSL VPN scanning, and Kubernetes reconnaissance. ELLIO characterized this as “indicative of the RCE being adopted by an operator focused on mass exploitation.”
That same day, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog, setting a federal agency remediation deadline of November 10, 2026, under Binding Operational Directive 26-04.
Far Beyond Node.js
The name “Node2Shell” stuck early, but the vulnerability’s reach extends well past Node.js. Because so many projects bundle or depend on Google’s Brotli decoder, the affected software list reads like a roll call of modern infrastructure:
Runtimes and languages: Node.js (versions 22, 24, 26 — fixed), Bun (1.0.21 to 1.4.3, fixed in 1.4.4), Python (PyPI brotli and brotlicffi packages), .NET 8, 9, and 10 (fixed in 8.0.33, 9.0.22, and 10.0.14, though .NET Framework is unaffected), plus bindings in Java (brotli4j), Ruby, PHP, Perl, and Go.
Web frameworks and proxies: Python’s requests, urllib3, aiohttp, and httpx libraries all decode Brotli responses automatically. Express 5 and body-parser 2.x accept Brotli-compressed request bodies by default. Envoy Proxy and Istio are vulnerable when Brotli decompression is enabled.
Embedded and vendored copies: As of October 26, projects including Pillow, Apache Arrow, DuckDB, ClickHouse, FFmpeg, 7-Zip-zstd, Git for Windows, and EDK II firmware still carried unpatched Brotli builds. Of roughly 80 tracked downstream products, only about 38 had shipped fixes, with 12 more in progress and 19 still vulnerable.
Microsoft issued emergency .NET patches, underscoring the severity. However, because .NET disables HTTP decompression by default, exposure requires explicit opt-in — a configuration choice that nevertheless many production services make.
How the Attack Works
There are two primary attack vectors. On the inbound path, an attacker sends a malicious request with a Content-Encoding: br header to any server that automatically decompresses request bodies — hitting the vulnerable decoder as the server processes the input. On the outbound path, an attacker-controlled server returns a crafted Brotli-compressed response to a client that decodes it, such as a webhook handler, a link previewer, a web crawler, or an AI browsing agent.
File-based vectors also exist. Brotli compression is embedded in formats including Parquet data files, WOFF2 web fonts, JPEG XL images, and certain PDF streams. Opening or processing any of these from an untrusted source could trigger the vulnerability.
Security firm Imperva has demonstrated successful code execution against an unmodified Node.js 24.22.0 arm64 build, though the company has not released its methodology. Public proof-of-concept exploits published on GitHub reportedly achieve RCE only on deliberately weakened builds, but the gap between PoC and weaponized exploit is narrowing quickly — as the KEV listing confirms.
What You Should Do Now
Given active exploitation and the broad attack surface, organizations should treat this as a high-priority patching event:
Inventory your Brotli exposure. The decoder is often buried deep in dependency trees. Audit not just your application code but container base images, sidecar proxies, and data-processing pipelines for vulnerable Brotli versions.
Patch and rebuild. Update dependency locks, rebuild affected applications and container images, and redeploy. For Node.js, upgrade to 22.23.4, 24.22.1, or 26.12.1. For .NET, apply the emergency patches (8.0.33, 9.0.22, or 10.0.14). For Python, update brotli and brotlicffi via pip. Check each vendor’s advisory for other platforms.
If you cannot patch immediately, consider blocking Brotli-compressed requests at your WAF or reverse proxy. Deploy updated IPS signatures (Suricata rules for malformed Brotli streams are already available) and monitor for repeated malformed Brotli requests or unusual outbound connections from application servers.
Retire end-of-life runtimes. Node.js 18, 20, 23, and 25 will not receive fixes. If you are running any of these versions, this is the forcing function to migrate.
What to Watch Next
The November 10 federal deadline will force a wave of patching across government infrastructure, but the private sector faces no such mandate. With exploit code circulating and at least one threat actor already incorporating CVE-2026-111497 into mass-exploitation campaigns, the window for pre-exploitation patching is effectively closed. The question now is whether organizations can patch faster than attackers can scale.
The deeper lesson echoes Log4Shell and PHP2Shell before it: widely embedded compression and parsing libraries are high-value targets precisely because they sit in every stack and are often invisible to the teams responsible for patching them. If Node2Shell accomplishes anything positive, it may be to finally push organizations toward systematic software composition analysis — before the next decoder-level vulnerability lands.
Leave a Reply