On October 21, Node.js shipped security releases for a flaw that deserves your immediate attention: CVE-2026-111497, nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder bundled with Node.js, scored 9.2 Critical under CVSS v4.0. One day after disclosure, researchers at Imperva demonstrated remote code execution on the official Node.js 24.22.0 image. No debugger, no custom build, just crafted compressed data.
How the bug works
Brotli streams are made of blocks. A stream that first declares a single block type and then switches blocks mid-stream should be rejected as invalid. The vulnerable decoder does not reject it. Instead it treats the impossible transition as a request for more input and keeps decoding in an invalid internal state, which writes past a buffer. That memory corruption is the primitive behind the crash, the memory disclosure and the code execution.
The flaw lives in Google's Brotli C library, which Node.js bundles. It was found and reported by Khai Tran and Sylvie Mayer of OpenAI's Codex Security team.
Who is affected
- Node.js 22.x, 24.x and 26.x before the patched releases
- Brotli library versions 1.0.3 to 1.2.0
- Anything bundling the same decoder, including Bun before 1.4.4 and the Python
Brotliandbrotlicffipackages before 1.2.1 / 1.2.1.0
Your application is only reachable if it decodes Brotli data an attacker controls. The two proven routes:
-
Inbound request bodies. In body-parser 2.x, which ships with Express 5,
express.json()decodes Brotli-compressed request bodies by default. Imperva reproduced execution through Express 5.0.0 to 5.3.0 with body-parser 2.0.0 to 2.3.0. -
Outbound responses. Node's built-in
fetch()automatically decompresses Brotli responses, so a server fetching an attacker's URL, or a compromised upstream, reaches the same decoder. No WAF rule in front of your API covers this path.
The fix
Upgrade to the patched release for your line and rebuild everything that pins an older Node binary:
| Line | Patched release |
|---|---|
| Node 22.x | 22.23.4 |
| Node 24.x | 24.22.1 |
| Node 26.x | 26.12.1 |
| Bun | 1.4.4 |
| Brotli lib | 1.0.10 / 1.1.1 / 1.2.1 |
There is no runtime workaround inside Node. Limiting untrusted Brotli traffic on exposed paths buys time, but it is not a fix.
Node 20.x and earlier are end of life and will not be patched. If you are still on 20 or below, this is your forced migration notice: move to a supported line.
Check every runtime you own:
node -v
# and inside your containers:
docker run --rm your-image node -v
How worried should you be?
Be precise, because the details matter. The public demonstration ran on Linux arm64, execution took several attempts, and failed attempts can crash the process, which your monitoring should notice. Other architectures and lines were not tested in that demo, but the underlying memory bug is the same code everywhere. As of October 22 to 23, no exploitation in the wild has been reported and the CVE is not in the CISA KEV catalog.
That is a reason to patch this week, not next quarter. A working proof of concept against an official build exists, the attack needs no authentication, and the exposed surface includes the most common Node stack on the internet. Patch first, then go find the runtimes you forgot about: CI images, lambdas, sidecar containers, the analytics box nobody has rebuilt since spring.
Run node -v on everything. Today.
Top comments (0)