---
schema: 1
kind: vulnerability
title: "CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)"
headline: "Node2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli packages"
summary: >
  Node.js released 22.23.4, 24.22.1 and 26.12.1 on 2026-10-21 to fix CVE-2026-111497, an out-of-bounds
  write in its bundled Brotli decoder that can lead to remote code execution, and Imperva ran code through
  it against the official Node.js 24.22.0 image via fetch() and Express 5 or body-parser 2 request bodies.
  The flaw is in the upstream Brotli library, so the PyPI packages Brotli (fixed in 1.2.1) and brotlicffi
  (fixed in 1.2.1.0) carry it too; no source reports exploitation.
discovered_at: "2026-10-24T03:33:00Z"
updated_at: null
event_date: "2026-10-21"
run_id: 2026-10-24T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [technology]
entities: ["tool:node2shell", "product:node-js", "product:google-brotli", "product:python-brotli-pypi", "product:brotlicffi-pypi"]
techniques: [T1190]
affected_products: ["Node.js", "Google Brotli", "Python Brotli (PyPI)", "brotlicffi (PyPI)"]
cves:
  - id: CVE-2026-111497
    cvss: "9.2 (CVSS 4.0)"
    epss: null
    type: memory-corruption
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1; Google Brotli 1.0.3 to 1.2.0; PyPI Brotli up to 1.2.0; PyPI brotlicffi up to 1.2.0.2"
    fixed: "Node.js 22.23.4, 24.22.1, 26.12.1; Google Brotli 1.0.10, 1.1.1, 1.2.1; PyPI Brotli 1.2.1; PyPI brotlicffi 1.2.1.0"
sources:
  - url: "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
    publisher: "Node.js project"
    date: "2026-10-21"
    role: primary
  - url: "https://nodejs.org/en/blog/release/v22.23.4/"
    publisher: "Node.js project (release v22.23.4)"
    date: "2026-10-21"
    role: primary
  - url: "https://nodejs.org/en/blog/release/v24.22.1/"
    publisher: "Node.js project (release v24.22.1)"
    date: "2026-10-21"
    role: primary
  - url: "https://nodejs.org/en/blog/release/v26.12.1/"
    publisher: "Node.js project (release v26.12.1)"
    date: "2026-10-21"
    role: primary
  - url: "https://github.com/google/brotli/releases/tag/v1.2.1"
    publisher: "Google Brotli"
    date: "2026-10-21"
    role: primary
  - url: "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-108169"
    publisher: "ENISA EUVD"
    date: "2026-10-23"
    role: corroborating
  - url: "https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/"
    publisher: "Imperva Threat Research"
    date: "2026-10-22"
    role: corroborating
  - url: "https://opensourcemalware.com/blog/node2shell-affects-python"
    publisher: "OpenSourceMalware"
    date: "2026-10-23"
    role: corroborating
closed_sources: []
evidence:
  - quote: "A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer."
    publisher: "Node.js project"
    source_url: "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
  - quote: "Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image."
    publisher: "Imperva Threat Research"
    source_url: "https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/"
verification: multi-source
sourcing_note: "The Node.js advisory names the affected release lines but not the fixed versions; the three release pages of 2026-10-21 list the flaw in their notes, and Imperva names the fixed versions together. Node.js rates the flaw high; the Google CNA record, read through ENISA's EUVD, scores it CVSS 4.0 9.2."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images, which a package inventory misses, and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; move any application on an end-of-life Node.js line to a supported release."
updates: []
migrated_from: null
---

Node.js shipped security releases on 2026-10-21 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles: an invalid block switch was reported as a need for more input instead of a format error, so the streaming decoder kept appending input to an eight-byte internal buffer ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). An attacker who can supply Brotli data that an application decompresses with the node:zlib module can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). Node.js rates it high ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)), and the Google CNA record scores it CVSS 4.0 9.2 with no authentication and no user interaction ([ENISA EUVD, 2026-10-23](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-108169)).

Imperva ran code carried in Brotli data against the official Node.js 24.22.0 Linux arm64 image, both through the built-in fetch() consuming a compressed response and through Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 request-body parsers (raw() and json()); execution took several attempts, and the fixed 24.22.1 rejected the same input ([Imperva, 2026-10-22](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)). A bare Node.js HTTP server does not decode an incoming Brotli body on receipt, so the request path needs those parsers ([Imperva, 2026-10-22](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)). Fixes are in Node.js 22.23.4, 24.22.1 and 26.12.1, whose release notes list CVE-2026-111497 as a high-severity Brotli fix ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/release/v22.23.4/); [Node.js project, 2026-10-21](https://nodejs.org/en/blog/release/v24.22.1/); [Node.js project, 2026-10-21](https://nodejs.org/en/blog/release/v26.12.1/)); end-of-life lines are always affected when a security release occurs ([Node.js project, 2026-10-21](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)). No source reports exploitation.

The decoder is Google's, so the flaw reaches beyond Node.js: Google released Brotli 1.2.1 on 2026-10-21 and lists CVE-2026-111497 in its release as an out-of-bounds write that permits remote code execution ([Google Brotli, 2026-10-21](https://github.com/google/brotli/releases/tag/v1.2.1)), and the CVE record covers Brotli 1.0.3 to 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1 ([ENISA EUVD, 2026-10-23](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-108169)). OpenSourceMalware found that the PyPI packages Brotli (up to 1.2.0, fixed in 1.2.1 on 2026-10-22) and brotlicffi (up to 1.2.0.2, fixed in 1.2.1.0 on 2026-10-23) compile the same decoder and that neither release's notes mention the flaw ([OpenSourceMalware, 2026-10-23](https://opensourcemalware.com/blog/node2shell-affects-python)); it found no advisory database listing either package when it wrote, and ENISA's record now carries PyPI advisories for them (PYSEC-2026-4322 and PYSEC-2026-4323) dated 2026-10-23, which cite OpenSourceMalware's post as their reference, so the PyPI exposure rests on its source diff ([ENISA EUVD, 2026-10-23](https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-108169)).

**Exposure:** a service on Node.js 22.x, 24.x or 26.x below the fixed releases that decodes Brotli from an untrusted party, either request bodies inflated by Express 5 or body-parser 2 or compressed responses that fetch() consumes from a server an attacker influences, and Python code that decompresses untrusted data with the PyPI Brotli or brotlicffi packages. A package inventory can miss a Node.js runtime bundled in a container, so check the version inside each deployed image or host ([Imperva, 2026-10-22](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)).

**Detection:** in web server, proxy and WAF logs, requests that carry a Brotli content encoding to endpoints that parse bodies, followed by process crashes or restarts in the supervisor or container logs. Imperva says unexpected process exits during decompression and decoder errors may help prioritise investigation but are not a reliable sign of exploitation on their own ([Imperva, 2026-10-22](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)).

**Defender takeaway:** replace the runtime and the two Python packages now; where an update has to wait, limit untrusted Brotli traffic on the affected paths and test the change against normal traffic, as Imperva advises ([Imperva, 2026-10-22](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)).