Node.js Brotli decoder flaw Node2Shell (CVE-2026-111497) now exploited in the wild

What happened

Node.js fixed CVE-2026-111497, a flaw in the Brotli decompression code it bundles, in its October 21, 2026 security releases: 22.23.4, 24.22.1 and 26.12.1. Malformed compressed input makes the decoder write past an internal buffer, which can crash the process, leak memory or allow remote code execution.

The root cause is small. An invalid block switch was treated as a temporary need for more input instead of a format error, so the streaming decoder kept appending attacker bytes to an eight-byte internal buffer. Node.js rated the bug high; the CVE record scores it 9.2 critical under CVSS v4.0. Belgium's CCB says exploit traffic carrying public exploit code has been seen since October 26, and CISA added the CVE to its KEV catalog on October 27 with a remediation deadline of November 10. The flaw also circulates as HTTP2Shell, Python2Shell and Broccoli2Shell; all are the same bug.

Why it matters

The vulnerable code is Google's Brotli decoder, not Node.js itself, so it runs wherever Brotli data gets decompressed: an incoming request body sent with Content-Encoding: br, a fetch() response from a server an attacker controls, or a direct node:zlib call. That makes ordinary API servers and anything that fetches remote content a target. Code execution lands with the privileges of the Node.js process.

Who is affected

• Node.js 22.x below 22.23.4, 24.x below 24.22.1 and 26.x below 26.12.1
• Node.js 25.x, 23.x, 20.x and older: end of life, no fix; move to a supported line
• Bun before 1.4.4
• PyPI Brotli before 1.2.1 and brotlicffi before 1.2.1.0
• Other software bundling Google Brotli 1.0.3 to 1.2.0; the upstream fix shipped as Brotli 1.2.1, 1.1.1 and 1.0.10

What to do now

1. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later.
2. Update Bun to 1.4.4 and the Python Brotli and brotlicffi packages if you use them.
3. Restart every running process and rebuild container images; a running process keeps the old decoder until it restarts.
4. Check the Node.js version itself, not process.versions.brotli, which still reports 1.2.0 on a patched build.
5. Treat exposed services that ran a vulnerable version since October 26 as possibly compromised, since patching does not undo past intrusions.

What we don't know yet

• Who is exploiting the flaw and against which targets.
• Whether the other flaws in the same release will be weaponized; CCB reports no exploitation of the three other high-severity bugs (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069).