Out-of-bounds write in the Brotli decoder
Crafted Brotli data triggers an out-of-bounds write in the library Node bundles, which can lead to a crash, memory disclosure or code execution.
Security advisory · Critical Node.js vulnerability · October 2026
node2shell: remote code execution in Node.js via Brotli
A critical flaw in the Brotli decompressor bundled in Node.js (CVE-2026-111497) can allow remote code execution when untrusted Brotli data is processed. Patches shipped on 21 October 2026, and a proof of concept exists — so patching now stays ahead of weaponization.
- CVSS 9.2 — Critical
- RCE via Brotli
- Proof of concept available
- Patch before it's weaponized
01 — Overview
CVE-2026-111497
What is node2shell?
“node2shell” (also called HTTP2Shell) is the name given to a critical flaw in the Brotli decompressor bundled inside Node.js (CVE-2026-111497). Carefully crafted Brotli data can cause an out-of-bounds write — which can crash the process, leak memory, or lead to command execution.
The flaw is in the library Node ships itself, so it affects any application that decompresses untrusted Brotli data. Other products that bundle the same library, such as Bun, are affected too.
02 — Affected systems
Are you affected?
You are exposed if your application decompresses Brotli data from a source you don't trust: built-in fetch() responses from external servers, Express 5 and body-parser 2.x request bodies that accept Content-Encoding: br, or direct use of node:zlib.
The version number may not be enough. If Node was installed through your OS package manager it may link the system Brotli, so node --version alone does not reflect your status — also check your system's Brotli library.
Node.js 26
Fixed in 26.12.1
Node.js 24
Fixed in 24.22.1
Node.js 22
Fixed in 22.23.4
Node.js 25 / 23 / 20
End of life — no official fix
Bun
Fixed in 1.4.4
03 — Severity
01
02
03
04
Why it matters
Critical (CVSS 9.2)
Google scores the flaw 9.2; the Node.js team rates it High.
Stock Node builds
The flaw is in the Brotli library bundled inside Node itself.
Through untrusted data
It triggers when you decompress Brotli from a source you don't trust — fetch() or Express request bodies, for example.
Code-execution proof of concept
Code execution has been demonstrated in research (unstable); no widespread exploitation confirmed yet — patch before that changes.
04 — Remediation
How to check and fix
The decisive fix is to update now. Until you do, reduce your exposure by refusing untrusted Brotli data.
1. Check your version
Find the Node version on every service — and note the OS-build caveat:
node --version # Node from an OS package may link the system Brotli — # also check your OS brotli / libbrotli package version
2. Update to a patched release
Upgrade to 22.23.4, 24.22.1 or 26.12.1 (and Bun to 1.4.4), then restart your app.
# with nvm nvm install 24.22.1 && nvm use 24.22.1 # then restart your app (pm2 / systemd / container) # Bun users: upgrade to 1.4.4
3. Reduce exposure in the meantime
Reject Brotli-encoded requests at your reverse proxy, and avoid decompressing Brotli from untrusted sources:
# nginx: reject Brotli-encoded request bodies
if ($http_content_encoding ~* "\bbr\b") { return 415; }4. Retire end-of-life versions
Node 20 and older (and 23 / 25) will not receive a fix; move to a supported LTS branch.
5. Defense in depth
Run with least privilege, never decompress data you don't trust, and enable a firewall and monitoring for anomalous behaviour.
05 — Reliant
How Reliant helps
We quickly determine whether your Node services are exposed to node2shell — which paths decompress untrusted Brotli — and give you a clear report of what to patch and in what order, then re-test to confirm.
- A fast exposure check for CVE-2026-111497 across your services and dependencies.
- Identifying paths that decompress untrusted Brotli (fetch, Express, zlib).
- Penetration testing for web applications and APIs.
- An actionable report with remediation steps and a verification re-test.