node2shell is the nickname for CVE-2026-111497, a critical out-of-bounds write in Google’s Brotli decompression library. Because Brotli is bundled inside Node.js, Bun, .NET and many other tools, a single crafted compressed request or response can crash a process, leak memory or, in some cases, run code. Here is what is affected, how to check your servers and exactly what to update.
🇪🇸 Leer en español
What Is node2shell?
Brotli is the compression format behind the br value in Content-Encoding. node2shell is a bug in its C decoder: a stream that declares one block type and then switches blocks was not rejected, so decoding continued in an invalid state and wrote past the end of a buffer. Researchers from OpenAI Codex Security reported it to Node.js.
Google rates it 9.2 Critical on CVSS 4.0, while Microsoft and Red Hat score it 8.1. Interestingly, the fix was committed to the Brotli source code back in February 2026, but no release shipped it until October 21.
Which Software Is Affected by node2shell?
| Software | Fixed in |
|---|---|
| Node.js 26.x | 26.12.1 |
| Node.js 24.x | 24.22.1 |
| Node.js 22.x | 22.23.4 |
| Node.js 20.x and older | no fix (end of life), upgrade |
| Bun | 1.4.4 |
| .NET 8 / 9 / 10 | 8.0.33 / 9.0.22 / 10.0.14 |
| PowerShell 7.4 / 7.5 / 7.6 | 7.4.22 / 7.5.13 / 7.6.9 |
| Brotli library | 1.0.10, 1.1.1, 1.2.1 |
Python brotli / brotlicffi | 1.2.1 / 1.2.1.0 |
| Envoy | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 |
| Istio | 1.31.2, 1.30.6, 1.29.9 |
Ruby brotli gem | 0.9.1 |
According to Cycode, Java’s brotli4j is fixed in 1.24.0, while curl_cffi had no fixed release yet. Debian, Red Hat and Amazon Linux have shipped fixed Brotli packages.
Is Your App Exposed to node2shell?
Two things must be true: a vulnerable runtime, and a way for attacker data to reach the Brotli decoder. For Node.js, common paths are:
- Express 5 with body-parser 2.x (json, urlencoded, text, raw). Express 4 and body-parser 1.x do not decode Brotli request bodies.
- Koa body parsers such as koa-bodyparser, @koa/bodyparser, koa-body and co-body.
- @fastify/compress with request decompression enabled.
- The built-in
fetch()when it downloads URLs supplied by users, because it decodes Brotli responses automatically. - Direct use of
node:zlibBrotli functions.
For .NET, Brotli decompression is off by default. You are exposed only if you enabled ASP.NET Core request decompression, HttpClient automatic decompression with Brotli, or use BrotliStream or BrotliDecoder directly. .NET Framework is not affected. For Python, requests, urllib3, httpx and aiohttp decode Brotli responses when the brotli or brotlicffi package is installed. pip itself is not affected.
How to Check Your Versions
node -v # Node.js
bun --version # Bun
dotnet --list-runtimes # .NET
pip show brotli brotlicffi # Python packages
# Debian/Ubuntu system library
dpkg -l | grep libbrotliDo not forget Docker images and build servers. A server that is up to date can still run an old Node.js inside a container.
How to Fix node2shell
- Update the runtime to the fixed versions in the table above. Node.js has published no workaround, so updating is the only real fix.
- Restart your services. Running processes keep the old decoder in memory.
- Rebuild container images with fresh base images, for example
docker build --pull, and redeploy. - Rebuild self-contained apps: .NET self-contained and NativeAOT apps, and Bun binaries built with
bun build --compile, carry their own copy. - Update Python packages:
pip install -U brotli brotlicffi, and check the versions yourself, because Dependabot may miss them.
Temporary Mitigations
If you cannot update today, reduce the risk at the edge:
- Reject requests with
Content-Encoding: brat your proxy or load balancer, matching case-insensitively and inside lists such asgzip, br. - Turn off inflation in your body parsers. Note that this also rejects gzip bodies.
- In Python, uninstall brotli and brotlicffi so clients fall back to gzip and deflate.
- In .NET, remove the Brotli provider from request decompression or HttpClient setups.
Removing br from your Accept-Encoding header is not enough, because a server can still send Brotli. These mitigations also do not cover Brotli responses read by fetch().
Is node2shell Being Exploited?
Not yet, as far as public reports go. CISA’s October 23 assessment listed exploitation as none, and Microsoft reported no exploitation as of October 25 but rates it as “more likely”. However, Imperva ran attacker code on an unmodified Node.js 24.22.0 build on Linux ARM64, and a public proof of concept exists. Given how fast PHP2Shell went from patch to real attacks, do not wait.
Frequently Asked Questions
Is node2shell the same as PHP2Shell?
No. They have similar names but are unrelated. PHP2Shell is a pair of bugs in PHP itself. node2shell (CVE-2026-111497) is a bug in the Brotli decompression library that Node.js, Bun, .NET and many other programs use.
Am I affected if I use Express?
Express 5 with body-parser 2.x decodes Brotli request bodies, so a vulnerable Node.js runtime behind Express 5 is exposed. Express 4 with body-parser 1.x does not decode Brotli request bodies, but you should still update Node.js.
Is node2shell exploited in the wild?
As of October 26, 2026, no in-the-wild exploitation had been reported and CISA listed exploitation as none. However, researchers have demonstrated code execution on Node.js 24.22.0, so patch quickly.
Is there a workaround for Node.js?
Node.js has published no workaround. Updating to 22.23.4, 24.22.1 or 26.12.1 is the fix. As a temporary measure, you can reject requests with Content-Encoding: br at your proxy.
Is .NET Framework affected?
No. Microsoft says .NET Framework is not affected. .NET 8, 9, 10 and 11 previews are, but only if your app enables Brotli decompression.
Get free security alerts
One short email when a critical vulnerability or a broken update needs your attention. No spam, unsubscribe anytime. See our privacy policy.
Sources
- Cycode: node2shell (CVE-2026-111497): What to Patch
- The Hacker News: Brotli decoder flaw also affects Bun, Python and more
- Microsoft .NET Blog: October 2026 out-of-band security updates
- Qualys: Node.js patches Brotli remote code execution flaw
More security news: PHP2Shell is now exploited, CVE-2026-115560 and Chrome 156.