Node2Shell is the name given to CVE-2026-111497, a high-severity flaw in the Brotli decoder bundled with Node.js. Malicious compressed data can write outside its memory buffer and may lead to code execution on the server. The fix is to upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, released on October 21, 2026.
What is Node2Shell?
It is an out-of-bounds write in the Brotli decoder that ships with Node.js: malformed compressed input makes the decoder write past the end of a memory buffer. The bug is in the Brotli library (versions 1.0.3 to 1.2.0), fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, so other software that bundles it may be affected too. Node.js rates it high severity and fixed it in its October 21 security release. It was reported by OpenAI Codex Security researchers.
Which Node.js applications are exposed to CVE-2026-111497?
Not every Node.js app: a Node.js HTTP server does not decompress Brotli on its own. The exposed ones decompress attacker-controlled Brotli data, through two paths:
Which Node.js versions fix Node2Shell?
Is Node2Shell being exploited?
As of October 22, no in-the-wild exploitation had been reported, but a public proof of concept has existed since that day. Imperva reproduced code execution on Node.js 24.22.0 through both paths (Express and fetch), though not on every attempt, and 24.22.1 rejects the same input. Other analyses note that on standard builds the proof mostly crashes the process and leaks a limited amount of memory. With public code, the window to patch gets shorter.
What should your company do today?
How does Rescue WAF protect you while you upgrade Node.js?
A web application firewall does not fix Node.js, but it reduces exposure on the most direct path, incoming requests. In Rescue WAF this is configured per site as a virtual patch:
The limit is clear: the WAF sees what comes in, not the responses your application fetches with fetch() from other servers. Only upgrading Node.js closes that path.
What does Rescue SOC add against Node2Shell?
Learn about Rescue SOC. If you suspect a server is already compromised, call our 24/7 incident response; after upgrading, a penetration test confirms the fix was applied. This week also brought PHP2Shell, the critical PHP flaw: if you run both languages, check both.
Node2Shell frequently asked questions
What is Node2Shell?
It is the name of CVE-2026-111497, a high-severity flaw in the Brotli decoder bundled with Node.js: malicious compressed data writes outside its memory buffer and may lead to code execution. It was fixed on October 21, 2026.
Is my Node.js application vulnerable to CVE-2026-111497?
Only if it decompresses attacker-controlled Brotli data: request bodies with Content-Encoding: br (for example with Express 5 or body-parser 2), responses it fetches with fetch() from servers you do not control, or code that runs brotliDecompress on untrusted data. A Node.js HTTP server without any of that is not affected.
Which Node.js version should I upgrade to?
22.23.4, 24.22.1 or 26.12.1, or later in each line. Node.js 20, 23 and 25 are end of life and will not get a fix.
Are Next.js or Express vulnerable?
The flaw is in Node.js, not the framework. Express 5 and body-parser 2 open the request path for Brotli; any app that uses fetch() against external servers opens the response path. Either way, the fix is to upgrade Node.js.
Is a WAF enough to protect against Node2Shell?
No. A WAF can block requests with Content-Encoding: br, but it does not see the responses your application fetches with fetch(). You must upgrade Node.js.
Is it being exploited?
As of October 22, 2026 no in-the-wild exploitation had been reported, but a public proof of concept has been available since that day.
Sources
- Aikido Security. Node2Shell: Node.js Brotli RCE (CVE-2026-111497). 2026 https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
- Imperva. Node2Shell: From Brotli Data to Remote Code Execution. 2026 https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
- Vercel. Node.js security advisory: Brotli decoder RCE (CVE-2026-111497). 2026 https://vercel.com/kb/bulletin/node-js-security-advisory
- SOC Prime. CVE-2026-111497: Node.js Brotli Decoder Flaw Enables Remote Code Execution. 2026 https://socprime.com/blog/cve-2026-111497-node-js-brotli-decoder-flaw-enables-remote-code-execution/
Do you have Node.js applications exposed to the internet?
We help you inventory them, apply the virtual patch in Rescue WAF and watch them with Rescue SOC while you upgrade.
Talk to a specialistYou may also like
Comments (0)
Be the first to comment.