What Is CVE-2026-111497 (Node2Shell)? Brotli Risk and Fix

CVE-2026-111497, nicknamed Node2Shell or HTTP2Shell, is a memory-corruption flaw in Google’s Brotli decompression library, not in Node.js itself. Because Brotli is bundled into Node.js, .NET, Python packages, proxies and Linux distributions, the fix means finding every copy, not just one runtime.

In plain English

Brotli is a compression format created by Google. Web servers use it to shrink pages and API responses, and browsers and HTTP clients expand them on arrival. Its decoder is copied into a long list of software, including the Node.js and Bun runtimes, Microsoft .NET, Python libraries, the Envoy and Istio proxies, several databases and some industrial products.

The flaw is in the decoder. A crafted Brotli stream can make it write past the end of a small internal buffer and corrupt nearby memory. According to the CVE record, the result can be a crash, leaked memory contents or, in some conditions, the attacker’s code running on the server. No login or user interaction is needed, only a way to get the crafted data to the decoder.

That is the important qualifier. You are at risk only if something in your stack decompresses Brotli data that an attacker can influence. Typical examples:

• A web application or API that accepts request bodies sent with Content-Encoding: br and decompresses them. Some frameworks do this automatically.
• An application that fetches content from URLs it does not control, such as webhooks, link previews or user-supplied URLs, with an HTTP client that automatically decompresses Brotli responses.
• Code that passes untrusted files or uploads straight to a Brotli decompression function.

A website that only sends Brotli-compressed pages to browsers is not, on that basis alone, exposed on the server side.

Where the nicknames come from

None of the nicknames comes from the vendors, which use only the CVE number. "Node2Shell" took hold after researchers at Imperva showed code execution against an official Node.js container image on 22 October 2026. Aikido’s follow-up research renamed it "HTTP2Shell" because the bug sits in a library shared by many HTTP clients and servers. The "HTTP2" does not mean the HTTP/2 protocol, and whether HTTP/2 is enabled makes no difference. Canada’s Cyber Centre calls it "Broccoli2Shell". All of these names refer to the same CVE.

Who is affected?

The root cause is in Google Brotli 1.0.3 through 1.2.0, code that first shipped in 2018. The table covers components with official fixed versions at the time of writing.

A few points about the table:

• End-of-life Node.js. The Node.js project states that end-of-life versions "are always affected when a security release occurs". Node.js 20 reached end of life on 30 April 2026. The only fix for 20, 23, 25 and older is a supported line.
• .NET. Microsoft’s advisory says .NET Framework is not affected. In .NET, exposure comes through ASP.NET Core request decompression with Brotli enabled (off by default), HttpClient automatic decompression that includes Brotli (off by default), or direct use of BrotliStream or BrotliDecoder on untrusted data.
• Other products. NVD also lists Bun (fixed in 1.4.4), Envoy, Istio, edk2, woff2, DuckDB, ClickHouse, Apache Arrow, p7zip and 7-Zip-ZSTD, and Siemens advisories (SSA-898633, SSA-443410, SSA-045512) cover several Industrial Edge and RUGGEDCOM products. Check each vendor’s advisory for its fixed version.

Linux distributions

Ubuntu has fixed brotli on all supported releases (Ubuntu Pro for 20.04 and 18.04). Debian has fixed it in bookworm (1.0.9-2+deb12u1, DLA-4855-1) and trixie (1.1.0-2+deb13u1), but its tracker still listed the packaged nodejs builds (18 in bookworm, 20 in trixie, both end-of-life upstream) as vulnerable with no fix when we checked. Updating the system brotli package does not fix a runtime that compiles in its own copy.

Containers, bundled runtimes and hosted platforms

This is where most of the work lies. Node.js, Bun and .NET bundle their own decoder, as do Electron-style desktop apps, single-file executables (such as Bun’s --compile output) and .NET self-contained or NativeAOT builds. Microsoft notes that updating the shared runtime "alone does not replace a decoder already linked into a NativeAOT executable". Container images on an older base tag stay vulnerable until rebuilt.

On serverless and platform-as-a-service hosting, the provider controls the runtime. Check its security notices and redeploy if asked. Some providers added firewall rules for inbound Brotli request bodies, but those don’t protect your application when it fetches Brotli content from elsewhere.

Technical analysis

The CVE record classifies the bug as CWE-787 (Out-of-bounds Write) with CWE-252 (Unchecked Return Value) as the underlying weakness. CISA’s catalogue entry names it a "Google Brotli Unchecked Return Value Vulnerability" (CISA KEV).

The Node.js advisory gives the clearest description. An invalid "block switch" in the stream was reported as a temporary need for more input rather than a format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer and wrote past its end, into decoder state. The upstream fix treats this condition as a hard error.

Public reporting agrees on several conditions for exploitation:

• The attacker must reach a decoder. A bare Node.js HTTP server does not decompress request bodies by itself. Middleware that honours Content-Encoding: br does, for example Express 5 with body-parser 2.x, according to Aikido’s analysis. So do fetch() calls that automatically decompress Brotli responses.
• Crashes are easy and code execution is harder. Researchers have shown code execution on unmodified official Node.js builds on arm64 and x86-64, but describe it as build-specific and unreliable (ELLIO). Failed attempts usually crash the process, a denial-of-service risk that can also write secrets to core dumps.
• The fix was public early. The upstream change was committed publicly on 27 February 2026, months before the releases on 21 October, which helps explain how fast proofs of concept appeared.

CVSS breakdown

AV:N means reachable over a network, AC:L low complexity, PR:N and UI:N no account or user action, and VC/VI/VA:H high impact on confidentiality, integrity and availability. Google’s v4.0 vector adds AT:P ("attack requirements: present"): the target must actually decompress attacker-supplied Brotli. That condition is why the vendor ratings sit below NVD’s 9.8. Treat your product vendor’s guidance as authoritative and NVD’s score as the worst case.

Is it being exploited?

Here is what is publicly confirmed as of 3 November 2026:

• 21 October 2026: Google released Brotli 1.0.10, 1.1.1 and 1.2.1, and Node.js released 22.23.4, 24.22.1 and 26.12.1.
• 22 October 2026: The CVE was published. Imperva researchers showed code execution on the official Node.js 24.22.0 container image (Linux arm64), and the patched 24.22.1 rejected the same input. Bun released 1.4.4 with the fixed decoder.
• 23 October 2026: Debian issued DLA-4855-1 for brotli in bookworm.
• 25 October 2026: Microsoft published its .NET advisory and updates. ELLIO published code execution on stock x86-64 Node.js builds.
• 26 October 2026: ELLIO reported that its internet sensors had seen scanning for hosts that decompress Brotli request bodies, followed by exploit traffic carrying a public exploit.
• 27 October 2026: CISA added CVE-2026-111497 to the KEV catalogue, with a remediation due date of 10 November 2026 for US federal agencies. CISA’s enrichment data on the CVE record marks exploitation as "active".
• 28 October 2026: Canada’s Cyber Centre issued alert AL26-027.

What is not publicly known: CISA has named no threat actor, victims or confirmed compromises, and lists ransomware use as "Unknown". ELLIO reported that the attack chain it captured did not achieve code execution in its own tests. We found no ASD’s ACSC (cyber.gov.au) or UK NCSC publication specific to this CVE at the time of writing. That does not lower the priority: a KEV listing is strong evidence someone is trying to use the bug.

How to fix it

1. Find every copy of the Brotli decoder. Check language runtimes first, then libraries, then everything else:

   • Node.js: run node -v. If you use Bun, run bun --version.
   • .NET: run dotnet --list-runtimes and dotnet --list-sdks.
   • Python: run pip show brotli brotlicffi and search lockfiles (requirements.txt, poetry.lock, uv.lock) for brotli, brotlicffi and extras such as httpx[brotli] or urllib3[brotli].
   • Go: run go list -m all | grep brotli.
   • Linux packages: use dpkg -l | grep brotli or rpm -qa | grep brotli.
   • Containers: scan your images and registries with your container scanner. If you keep SBOMs, query them for brotli and the runtimes listed above.

   Check: you have a list of hosts, images, functions and desktop apps, each with its runtime or library version and whether it is internet-facing.

2. Prioritise what decompresses untrusted Brotli: request decompression middleware, clients that fetch user-supplied URLs, webhook receivers and file processing. Check: each internet-facing service is marked "decodes untrusted Brotli: yes/no/unknown". Treat "unknown" as yes.

3. Upgrade to the fixed versions in the table above (Bun: 1.4.4), apply your distribution’s patched brotli package, and move Node.js 20, 23, 25 or older to a supported line. Check: the version command from step 1 now reports a fixed version on every system.

4. Rebuild and redeploy what bundles its own copy: container images (from an updated base image, not a cached layer), .NET self-contained and NativeAOT apps (update the SDK, then republish), Bun compiled executables and serverless packages. Check: a fresh image scan shows no vulnerable Brotli, Node.js, .NET or Python package, and the running containers use the new image digest.

5. Restart services. A patched library on disk does nothing until the process using it reloads. Check: process start times are later than the patch time, and health checks pass.

6. Where you cannot patch yet, use official interim mitigations. Node.js lists no workaround. Microsoft advises removing Brotli from request or HttpClient decompression where you already use it (and not adding new decompression settings). Canada’s Cyber Centre advises not processing Brotli from untrusted sources. Rejecting inbound Content-Encoding: br at a proxy or web application firewall is a stopgap that does not protect outbound fetches. Check: a test request with Content-Encoding: br sent to the protected endpoint is rejected, and the exception is logged with an end date.

7. Monitor and confirm. Watch for unexpected crashes, core dumps (treat them as sensitive), unusual child processes or outbound connections from web workers. Check: alerts exist for repeated web process crashes, and any unexplained crash loops since 21 October have been investigated.

What this means for businesses

If you build or run web applications, this is a supply-chain patch, not a single upgrade. Developers may have updated Node.js on their laptops while production still builds from an old base image, a Python worker pulls Brotli in through an optional extra, and the proxy carries its own copy. If you cannot quickly list where Brotli runs, that gap is worth fixing beyond this one CVE.

If you use hosted platforms or SaaS, the provider owns the runtime but you often own the redeploy. Confirm the runtime version your apps use. For SaaS, asking "Are you affected by CVE-2026-111497, and when did you patch?" is reasonable.

If vendors build or host software for you, ask for evidence: versions before and after, images rebuilt, and the date. Agencies often run many client sites on similar stacks, so one missed base image can expose several.

For operational technology and appliances, the Siemens advisories show Brotli turns up in unexpected places. Ask equipment vendors directly.

Finally, this is a good test of your patch process. The bug went from coordinated release to CISA’s exploited list within a week. Teams that could answer "where do we run this?" within a day were far better placed.

Key takeaways

• CVE-2026-111497 is a Google Brotli decoder flaw that can corrupt memory and may allow remote code execution. "Node2Shell" and "HTTP2Shell" are informal nicknames, and the bug is unrelated to the HTTP/2 protocol.
• You are exposed if anything you run decompresses Brotli data an attacker can supply, such as request bodies, fetched responses or uploaded files.
• CISA lists it as known exploited (added 27 October 2026), and public proofs of concept exist. Treat it as urgent for internet-facing services.
• Patch every copy to a fixed version and retire end-of-life Node.js lines.
• Rebuild containers and self-contained apps, then restart services. Updating the OS package alone is not enough.
• Blocking inbound Brotli request bodies is a stopgap only. It does not protect outbound fetches.

Sources

• CVE-2026-111497 record (CVE.org)
• NVD: CVE-2026-111497
• Node.js October 2026 security releases
• Node.js release schedule
• Google Brotli v1.2.1 release
• GitHub Advisory GHSA-9v8h-qqgm-4m35
• Microsoft .NET security advisory (dotnet/announcements #494)
• CISA Known Exploited Vulnerabilities catalogue entry
• Canadian Centre for Cyber Security alert AL26-027
• Debian security tracker and DLA-4855-1
• Ubuntu CVE entry
• Aikido research post and ELLIO research post