● Covered by 4 sources · 9 reportsMedium impact3 negative6 neutral
Node.js Updates Fix Brotli Decoder RCE Vulnerability Across Supported Versions
Key points
- Node.js updated versions 22.x, 24.x, 26.x to fix 10 security flaws.
- Most severe flaw is an RCE in bundled Brotli decoder (out-of-bounds write).
- Exploitable when decompressing attacker-controlled Brotli data.
- Unsupported Node.js versions (20.x and earlier) will not receive the fix.
- The vulnerability is tracked as CVE-2026-111497.
- The flaw was initially dubbed "Node2Shell" but affects many HTTP libraries and applications.
- Python packages were vulnerable to CVE-2026-111497.
- The vulnerability affects Bun, Envoy, and C++.
- Patches are available for libbrotli, Python, C++, NodeJS, Bun, and Envoy.
- Apache and Nginx do not decode Brotli by default.
- OpenAI discovered this vulnerability in February.
- The root cause was fixed in Brotli source code in February.
- The flaw allows crafted compressed data to overwrite past the end of a buffer.
- Imperva researchers demonstrated code execution on an unpatched Node.js build.
- Microsoft released fixes for .NET, Visual Studio, and PowerShell on October 25.
- Istio has also been updated.
- The bug impacts Brotli versions 1.0.3 through 1.2.0.
- Google assigned a CVSS v4 score of 9.2 to the vulnerability.
- Brotli versions 1.0.10, 1.1.1, and 1.2.1 contain the fix.
- OpenAI Codex Security members discovered the vulnerability during red-teaming work.
- The flaw is also known as "Broccoli2Shell" and "HTTP2Shell".
- Attackers can exploit the flaw to remotely escalate privileges on unpatched .NET installations with non-default configurations.
- Microsoft's advisory was published on Sunday.
- The vulnerability affects Brotli versions 1.0.3 through 1.0.9 and 1.1.0.
- Brotli is an open-source project developed and maintained by Google.
- The vulnerability affects Python HTTP clients like urllib3[brotli], requests, httpx, and aiohttp[speedups].
- CISA added CVE-2026-111497 to its KEV catalog on October 27.
- Federal agencies must patch CVE-2026-111497 by November 10.
- Security firms Previdian and ELLIO detected exploitation attempts against honeypots.
- Node.js and Google released fixes on October 21.
- Palo Alto Networks is rolling out hotfixes for PAN-OS.
- CISA confirmed active exploitation of CVE-2026-111497 on Tuesday.
- The flaw allows unprivileged attackers to trigger crashes or memory leaks.
Node.js Security Updates Released
Node.js issued security updates on October 21 for its currently supported release lines: 22.x, 24.x, and 26.x. These updates address a total of 10 security vulnerabilities. Specific patched versions are 22.23.4, 24.22.1, and 26.12.1. Node.js versions 20.x and older have reached end-of-life and will not receive these fixes, requiring users to migrate to a supported release line.
Critical Brotli Decompression Vulnerability
The most significant vulnerability is an out-of-bounds write in the bundled Brotli decompression code, which Node.js describes as potentially allowing remote code execution. This flaw is triggered by malformed compressed input. The affected code runs whenever Node.js decompresses Brotli data, either via the node:zlib module or automatically when fetch() is called on a Brotli-compressed response. Applications are vulnerable if they decompress Brotli data supplied by an attacker, such as in request bodies or fetched responses.
Brotli Project Upstream Fix
The fix for the Brotli flaw originates from an upstream patch by the Brotli project itself. This patch modifies the decoder to detect and halt processing of invalid input earlier, preventing buffer overflows. The same fix was included in Brotli versions 1.2.1, 1.1.1, and 1.0.10, released on October 21. Other software that bundles the Brotli library may also require similar updates. While Node.js rates the flaw as high severity with RCE potential, a public proof-of-concept only achieved code execution on a weakened test build, resulting in a crash and limited memory read on standard builds.
Other High-Severity Flaws
In addition to the Brotli vulnerability, three other high-severity flaws were addressed. These involve TLS certificate checks that could be bypassed. Attackers could use unusual IP address formats in server certificates to make them match hosts they should not, leading to improper certificate validation (CVE-2026-106069 and CVE-2026-10548).
Updates
- CISA confirmed active exploitation of CVE-2026-111497 on Tuesday.
- The flaw allows unprivileged attackers to trigger crashes or memory leaks.
- CISA added CVE-2026-111497 to its KEV catalog on October 27.
- Federal agencies must patch CVE-2026-111497 by November 10.
- Security firms Previdian and ELLIO detected exploitation attempts against honeypots.
- Node.js and Google released fixes on October 21.
- Palo Alto Networks is rolling out hotfixes for PAN-OS.
- The flaw is also known as "Broccoli2Shell" and "HTTP2Shell".
- Attackers can exploit the flaw to remotely escalate privileges on unpatched .NET installations with non-default configurations.
- Microsoft's advisory was published on Sunday.
- The vulnerability affects Brotli versions 1.0.3 through 1.0.9 and 1.1.0.
- Brotli is an open-source project developed and maintained by Google.
- The vulnerability affects Python HTTP clients like urllib3[brotli], requests, httpx, and aiohttp[speedups].
- Microsoft released fixes for .NET, Visual Studio, and PowerShell on October 25.
- Istio has also been updated.
- The bug impacts Brotli versions 1.0.3 through 1.2.0.
- Google assigned a CVSS v4 score of 9.2 to the vulnerability.
- Brotli versions 1.0.10, 1.1.1, and 1.2.1 contain the fix.
- OpenAI Codex Security members discovered the vulnerability during red-teaming work.
- The vulnerability is tracked as CVE-2026-111497.
- The flaw was initially dubbed "Node2Shell" but affects many HTTP libraries and applications.
- Python packages were vulnerable to CVE-2026-111497.
- The vulnerability affects Bun, Envoy, and C++.
- Patches are available for libbrotli, Python, C++, NodeJS, Bun, and Envoy.
- Apache and Nginx do not decode Brotli by default.
- OpenAI discovered this vulnerability in February.
- The root cause was fixed in Brotli source code in February.
- The flaw allows crafted compressed data to overwrite past the end of a buffer.
- Imperva researchers demonstrated code execution on an unpatched Node.js build.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub nodejs/Release GitHub google/brotli GitHub nodejs/node GitHub nodejs/undici CVE CVE-2026-1060697.4 HIGH CVE CVE-2026-1054837.4 HIGHHow outlets covered it
The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of CVE-2026-111497, a critical out-of-bounds write flaw in the Brotli decoder. This vulnerability, known as Node2Shell, allows unprivileged attackers to trigger crashes, memory leaks, or remote code execution via crafted Brotli-compressed streams. CISA has added it to its Known Exploited Vulnerabilities Catalog and mandated federal agencies to patch by November 10.
CISA added the Brotli Node2Shell vulnerability (CVE-2026-111497) to its Known Exploited Vulnerabilities catalog, instructing federal agencies to patch by November 10. Security firms Previdian and ELLIO reported detecting exploitation attempts against their honeypots, indicating active targeting of the flaw.
A critical vulnerability, CVE-2026-111497 (HTTP2Shell/Node2Shell), in the Brotli C decoder library allows memory corruption and potential remote code execution. This flaw affects Brotli versions 1.0.3-1.0.9, 1.1.0, and 1.2.0, impacting Node.js, Python HTTP clients, and other applications using vulnerable Brotli implementations, leading to emergency patches from vendors like Microsoft.
Microsoft issued emergency security updates for .NET to address a critical vulnerability, CVE-2026-111497, in the Brotli decoder. This flaw, also known as Broccoli2Shell, could allow remote code execution or privilege escalation through maliciously crafted Brotli-compressed data. The updates are crucial for applications using Brotli decompression in .NET environments.
A critical vulnerability (CVE-2026-111497), dubbed Node2Shell, in Google's Brotli data compression library has prompted security updates from Microsoft, Node.js, and Python package maintainers. The flaw, an out-of-bounds write, could lead to crashes, memory leaks, or arbitrary code execution, affecting Brotli versions 1.0.3 through 1.2.0.
A memory-corruption flaw (CVE-2026-111497) in Google's Brotli decoder allows crafted compressed data to corrupt memory, potentially leading to crashes or code execution. This vulnerability impacts multiple software components including Bun, Python Brotli packages, and Node.js, requiring individual updates for each affected program.
A critical out-of-bounds write vulnerability (CVE-2026-111497) in Google's Brotli compression library, initially dubbed "Node2Shell," has been found to affect numerous programming languages and HTTP-based applications. This flaw allows remote attackers to corrupt memory, leak data, crash processes, or execute arbitrary code by sending crafted Brotli-compressed data.
Security researchers at Imperva demonstrated a remote code execution (RCE) exploit, dubbed "Node2Shell," on an official Node.js build (24.22.0) by feeding crafted Brotli data to its bundled decoder. This vulnerability (CVE-2026-111497) affects Node.js versions 22.x, 24.x, and 26.x, and applications that decode untrusted Brotli data should update to patched versions released on October 21.
Node.js released security updates for versions 22.x, 24.x, and 26.x to address 10 flaws, including a high-severity remote code execution (RCE) vulnerability in its bundled Brotli decompression code. This flaw, an out-of-bounds write, could allow an attacker to run arbitrary code if an application decompresses attacker-controlled Brotli data. Users of unsupported Node.js versions (20.x and earlier) must upgrade to a supported line to receive the fix.