CVE-2026-111497 node2shell Response Guide

node2shell is a remote code execution (RCE) vulnerability (CVE-2026-111497) in the Brotli decompression decoder built into Node.js.
An external attacker, without logging in, can corrupt the memory of a Node.js process using nothing but crafted Brotli-compressed data, and execute arbitrary code if the conditions are right.

What to do first, by role

Security officers

Start by finding every service that runs on Node.js. The bug is not in an npm package but in the Brotli decoder included in the Node.js runtime. It does not show up in the package list (package.json), so you need to check the actual runtime version (node -v) on every server, container image, and build server.

The priority is wherever external data is decompressed with Brotli. Top priority goes to Express 5 / body-parser 2 services that decompress request bodies sent with Content-Encoding: br, and to services that use fetch() to retrieve external URLs whose responses an attacker can manipulate.

CISOs

The Node.js project rated it High, and Google, which issued the CVE, rated it CVSS 9.2 Critical. The Imperva Red Team demonstrated remote code execution on the official Node.js 24.22.0 image (Linux arm64), the version just before the fix. There are no reports of real-world attacks yet, but its EPSS score is in the top 1.7%.

No patches will be released for the end-of-life 20.x, 23.x, and 25.x lines. Services on these versions need migration to a supported version rather than an update, so schedule that separately. Response is only fast if you have a list (SBOM) of which services run on which runtime versions.

Developers

Upgrading the runtime is the only complete fix. The official Node.js notice offers no workaround. Upgrade 22.x to 22.23.4, 24.x to 24.22.1, and 26.x to 26.12.1 or later, and change the Docker base image tags, .nvmrc, and the Node.js version on CI runners as well. After the change, you must restart the processes for the new runtime to take effect.

If you cannot upgrade right away, buy time by rejecting Content-Encoding: br requests at the reverse proxy or in middleware. Note, however, that this does not block Brotli responses retrieved with fetch().

Small businesses and outsourced operations

Check the affected versions and patch. If a development or operations vendor runs your website or service, ask them “Have you upgraded Node.js to 22.23.4, 24.22.1, or 26.12.1 or later, and restarted the services after upgrading?” If you use a cloud or hosting service, check the provider’s notice first.

If you are on an end-of-life version such as Node.js 20 or earlier, no patch will be released, so work out a schedule with your vendor to move to a supported version.

CVE details

The Brotli decoder built into Node.js treated an invalid block switch not as a permanent format error but as a temporary state needing more input. As a result, the streaming decoder keeps appending input bytes to an 8-byte internal buffer and writes past the end of the buffer. If an attacker can send Brotli data that is decompressed with node:zlib, they can corrupt process memory, which can lead to process termination, memory disclosure, or remote code execution (RCE).

The description above is based on the Node.js security notice.

KEV and EPSS were retrieved at 2026-10-26 13:19 KST and change frequently.

Brotli and node2shell, made simple

What is Brotli?

A compression format created by Google. Like gzip, it is used to reduce the size of data exchanged on the web. Node.js includes the code that decompresses it (the decoder) directly in the runtime.

What went wrong?

When the decoder meets invalid data it should stop, but it mistook this for “the data hasn’t all arrived yet.” So it keeps pushing data into a small 8-byte slot and writes beyond the slot. It is like cramming more and more items into a small box until they spill into the next compartment.

Why does it go as far as code execution?

When the overflowing data overwrites neighboring memory, the process can crash, memory contents can leak, or code planted by the attacker can run. No login is needed. However, the attack only works if the app actually decompresses that data. Examples are when Express 5 / body-parser 2 decompresses a request body, and when fetch() receives a response from an attacker’s server.

Affected and fixed versions

Because the code is part of the Node.js runtime, updating npm packages does not fix it. The runtime itself has to be upgraded.

Sources and references

• NVD · CVE-2026-111497 — nvd.nist.gov
• Node.js · October 2026 security releases — Vendor Advisory · nodejs.org
• Imperva Red Team · node2shell analysis — Third Party Advisory · imperva.com
• broccoli2shell.com · public site — vulnerability summary · alias list · broccoli2shell.com