Node2Shell (CVE-2026-111497): decompressing a Brotli stream can run code in Node.js — patch to 22.23.4, 24.22.1, 26.12.1
CVE-2026-111497, known as Node2Shell, is an out-of-bounds write in the Brotli decoder built into Node.js and Bun: decompressing a crafted stream can crash the process, leak memory or run attacker code. Node.js fixed it on October 21, 2026 in 22.23.4, 24.22.1 and 26.12.1, Google rated it 9.2 (critical) under CVSS 4.0, and the reporters were OpenAI Codex Security researchers
The three lines
- Bug — the Brotli decoder accepts an invalid block switch and writes past an 8-byte buffer
- Exposure — any path that decodes untrusted Brotli: Express 5 bodies, fetch() responses
- Fix — upgrade Node.js or Bun (1.4.4); there is no full workaround
Key questions
- CVE-2026-111497 fixed versions
- **Three Node.js lines, plus Bun and the Brotli library.** | Target | Fixed in | |---|---| | Node.js 22 | 22.23.4 | | Node.js 24 | 24.22.1 | | Node.js 26 | 26.12.1 | | Bun | 1.4.4 | | Google Brotli (C, Python) | 1.0.10, 1.1.1, 1.2.1 | | Node.js 20 and older | End of life, no patch |
- Am I affected by node2shell
- **Yes, if your code decompresses Brotli data from outside.** | Path | Exposed | |---|---| | Express 5 / body-parser 2.x bodies | Yes | | Express 4 / body-parser 1.x | No by default | | Built-in fetch() of user-supplied URLs | Yes | | node:zlib brotliDecompress on untrusted input | Yes | | Bare http server | No automatic decoding |
- Is Node2Shell exploited in the wild
- **No exploitation reported as of October 23.** | Item | Status | |---|---| | Public proof of concept | Yes (Imperva, Node.js 24.22.0 arm64 image) | | In-the-wild attacks | None reported | | CISA KEV catalog | Not listed |
Opening a compressed response can be enough to hand over a Node.js server. Node.js shipped security releases on October 21, 2026 fixing ten issues. The most serious is CVE-2026-111497, dubbed Node2Shell, an out-of-bounds write in the bundled Brotli decoder that Google scored 9.2 (critical) under CVSS 4.0.
The bug was found by an AI security team: the advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security. It arrives as security researchers warn that AI-found flaws are outpacing maintainers' ability to patch.
1. The bug
Brotli is Google's compression format, widely used for web and API responses (Content-Encoding: br). Node.js embeds Google's C library.
| Item | Detail |
|---|---|
| Class | Out-of-bounds write (CWE-787) |
| Location | Block-switch handling in the Brotli decoder |
| Mechanism | A stream declares one block type, then switches; the decoder treats it as "needs more input" and keeps writing past an 8-byte buffer |
| Impact | Crash, memory disclosure, remote code execution |
| Affected | Node.js 22, 24, 26; Bun; Google Brotli 1.0.3–1.0.9, 1.1.0, 1.2.0 (including the Python package) |
| Upstream fix | Committed to google/brotli on February 27, 2026, without a release or advisory |
The upstream fix sat in Google's repository for eight months before Node.js shipped it. The npm package named brotli is unrelated; the problem is in the runtime.
2. Are you exposed?
| Code path | Exposed | Note |
|---|---|---|
Express 5 / body-parser 2.x (json(), urlencoded(), text(), raw()) | Yes | Decodes Brotli request bodies |
| Express 4 / body-parser 1.x | No | No Brotli decoding |
| Koa body parsers | Yes | — |
| Fastify with @fastify/compress request decompression | Yes | When enabled |
Built-in fetch() of user-supplied URLs | Yes | Decodes Brotli responses |
node:zlib Brotli functions | If input is untrusted | — |
Bare http server | No | No automatic decoding |
bun build --compile binaries | Yes | Rebuild required |
Features that fetch URLs on a user's behalf — link previews, webhook checks, AI agents browsing the web — are the riskiest: an attacker only needs to serve a crafted Brotli response.
3. What to do
| Action | Detail | Limit |
|---|---|---|
| Upgrade (the only real fix) | Node.js 22.23.4, 24.22.1, 26.12.1; Bun 1.4.4 | Rebuild base images and build hosts |
| Stopgap 1 | Reject Content-Encoding: br at the proxy, case-insensitively, including lists like gzip, br | Does not cover fetch() responses |
| Stopgap 2 | Disable inflation in body parsers | Also rejects gzip bodies |
| End-of-life lines | No patch for Node.js 20 and older | Move to a supported line |
As of October 23 there are no reports of exploitation and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, but Imperva says it demonstrated code execution on the official Node.js 24.22.0 arm64 image.
4. The bigger picture
- AI-found bugs: The same week, Fortinet pre-announced critical flaws credited to frontier-AI-assisted research for coordinated disclosure on November 10.
- Upstream lag: Other ecosystems that bundle Brotli need to be checked against their own advisories.
- Also fixed: Three more High issues in the same release, including TLS identity checks fooled by fullwidth-digit and octal IP spellings, and DNS truncation at NUL bytes.