Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines

What happened

On 21 October 2026, Node.js released security updates for its three supported lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is CVE-2026-111497, an out-of-bounds write in the Brotli decompression code that Node.js bundles. The project describes the outcome as remote code execution.

The flaw is in code Node.js ships, not in your own program. Node runs that code whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when code calls fetch() on a response sent with Brotli compression. A crafted Brotli stream can make the decoder continue past a block transition the stream's own structure made impossible, carry on with an invalid internal state, and write past its buffer.

On 22 October, Imperva researcher Ron Masas published an analysis naming the flaw Node2Shell. Imperva said its proof of concept ran attacker-supplied code in applications using the official Node.js 24.22.0 Linux arm64 image, without a debugger or a custom build. It reported that patched Node.js 24.22.1 rejected the same inputs, that execution took multiple attempts, and that it tested only Linux arm64 builds and its own configurations. No exploitation in the wild has been reported as of 23 October.

Node.js rates the Brotli flaw high rather than critical, and no CVSS scores have been published for any of the 10 issues.

Timeline

• Feb 2026: the fix was first made in Brotli's source.
• 21 Oct: Node.js ships 22.23.4, 24.22.1 and 26.12.1, fixing 10 flaws and adding the eMudhra block. Brotli 1.2.1, 1.1.1 and 1.0.10 ship the same fix.
• 22 Oct: Imperva publishes the Node2Shell analysis with a working PoC against 24.22.0.
• 22 Oct: no exploitation in the wild reported.

Am I affected?

You are exposed if a Node.js service decodes Brotli data from outside its trust boundary. Two paths matter:

• A response consumed by Node's built-in fetch() when the remote server sends Content-Encoding: br.
• A request body decoded by Express 5.0.0 to 5.3.0 or body-parser 2.0.0 to 2.3.0.

Imperva notes that a bare Node.js HTTP server does not decode incoming Brotli bodies on its own, so request-side exposure depends on middleware being configured to decompress them.

The vulnerable code lives in the runtime, so a package inventory will miss it. Check the Node version inside container images, single-executable applications (SEAs), version managers such as nvm, bundled runtimes and serverless functions such as AWS Lambda. Node.js 25.x, 23.x, 21.x, 20.x and earlier have no fix and must be moved to a supported line.

What to do now

1. Upgrade to the fixed release for your line: 22.23.4, 24.22.1 or 26.12.1. Any later release in the same line also includes the fix.
2. If you run 26.x, upgrade to 26.12.1 before it becomes LTS on 28 October.
3. Move any runtime on 25.x, 23.x, 21.x, 20.x or earlier to a supported line. There is no fix for those.
4. Rebuild and redistribute SEAs and snapshot-based apps with a patched runtime.
5. Rebuild container images on the patched version and redeploy running containers.
6. While updates roll out, limit untrusted Brotli traffic on affected paths. Note that firewall or WAF rules do not cover Brotli responses your application fetches from other servers, and do not replace upgrading.

How to hunt

• Run node -v on every host and compare against the fixed versions.
• Find runtimes outside standard paths: find / -name node -type f 2>/dev/null.
• List services that decode Brotli: look for fetch() usage, and for Express 5 or body-parser with decompression enabled.
• Inspect running containers and images for the bundled Node version, not just the package manifest.
• Check for distributed SEAs and snapshots that embed an old runtime.

What does not help

• Updating npm dependencies. The vulnerable code is in the Node.js runtime, not in application packages, so dependency checks will not surface it.
• WAF or firewall rules alone. Vercel added rules on 21 October that block the attack in inbound requests, but these do not cover Brotli responses fetched from other servers and do not replace the upgrade. There is no workaround within Node itself.

Sources

• Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions, The Hacker News, 22 Oct
• Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do, Qualys Threat Research, 23 Oct
• Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept, Cyber Kendra, 22 Oct
• After PHP and eMudhra, Here Comes Node.js, Checkmarx Zero, 22 Oct
• Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data, The Hacker News, 23 Oct