Node.js and Google Brotli (Node2Shell): out-of-bounds write in the Brotli decoder lets crafted compressed data run code via fetch() and Express 5 or body-parser 2 request bodies (CVSS 4.0 9.2); fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.2.1 and PyPI Brotli 1.2.1 and brotlicffi 1.2.1.0

CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)

Node.js shipped security releases on 2026-10-21 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles: an invalid block switch was reported as a need for more input instead of a format error, so the streaming decoder kept appending input to an eight-byte internal buffer (Node.js project, 2026-10-21). An attacker who can supply Brotli data that an application decompresses with the node:zlib module can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution (Node.js project, 2026-10-21). Node.js rates it high (Node.js project, 2026-10-21), and the Google CNA record scores it CVSS 4.0 9.2 with no authentication and no user interaction (ENISA EUVD, 2026-10-23).

Imperva ran code carried in Brotli data against the official Node.js 24.22.0 Linux arm64 image, both through the built-in fetch() consuming a compressed response and through Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 request-body parsers (raw() and json()); execution took several attempts, and the fixed 24.22.1 rejected the same input (Imperva, 2026-10-22). A bare Node.js HTTP server does not decode an incoming Brotli body on receipt, so the request path needs those parsers (Imperva, 2026-10-22). Fixes are in Node.js 22.23.4, 24.22.1 and 26.12.1, whose release notes list CVE-2026-111497 as a high-severity Brotli fix (Node.js project, 2026-10-21; Node.js project, 2026-10-21; Node.js project, 2026-10-21); end-of-life lines are always affected when a security release occurs (Node.js project, 2026-10-21). No source reports exploitation.

The decoder is Google's, so the flaw reaches beyond Node.js: Google released Brotli 1.2.1 on 2026-10-21 and lists CVE-2026-111497 in its release as an out-of-bounds write that permits remote code execution (Google Brotli, 2026-10-21), and the CVE record covers Brotli 1.0.3 to 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1 (ENISA EUVD, 2026-10-23). OpenSourceMalware found that the PyPI packages Brotli (up to 1.2.0, fixed in 1.2.1 on 2026-10-22) and brotlicffi (up to 1.2.0.2, fixed in 1.2.1.0 on 2026-10-23) compile the same decoder and that neither release's notes mention the flaw (OpenSourceMalware, 2026-10-23); it found no advisory database listing either package when it wrote, and ENISA's record now carries PyPI advisories for them (PYSEC-2026-4322 and PYSEC-2026-4323) dated 2026-10-23, which cite OpenSourceMalware's post as their reference, so the PyPI exposure rests on its source diff (ENISA EUVD, 2026-10-23).