The web application development ecosystem has recently been shaken by the discovery of a critical (Critical) vulnerability in Node.js. On October 21, 2026, the Node.js project released an emergency security update to patch 10 security flaws, with one vulnerability drawing the most attention: CVE-2026-111497.
With a CVSS score of 9.2, this flaw allows attackers to perform Remote Code Execution (RCE) by exploiting the Brotli compression feature integrated into Node.js. Security researchers have dubbed this threat “Node2Shell” or “HTTP2Shell” because it can give attackers direct shell access.
Breaking Down the Node2Shell Vulnerability (CVE-2026-111497)#
The root of this vulnerability is not in the JavaScript programming language itself, but in Brotli—Google’s data compression library, bundled by Node.js as an internal dependency.
When a Node.js application receives and decompresses Brotli-formatted data from an untrusted source (for example, through an HTTP client, a proxy that accepts Content-Encoding: br, or a compressed file upload feature), the data decoding process begins.
The flaw (Out-of-Bounds Write): The vulnerability occurs when the Brotli decoder receives compressed data deliberately crafted (manipulated) by an attacker. When the decoder encounters an invalid “block switch” format in the data, it fails to recognize it as a format error. Instead of stopping the process, the system treats it as a temporary need for additional input.
As a result of this logic flaw, the decoder processing data as a stream repeatedly adds input bytes to an 8-byte internal buffer. This causes the data to overflow and overwrite memory outside the allocated buffer—a flaw known as an Out-of-Bounds Write.
This memory corruption provides a path to code execution. If an attacker crafts a precise byte payload, the overflow can be manipulated into commands. The attacker can then execute code remotely (RCE) with the same privileges as the running Node.js process.
Escalation and Ecosystem Impact#
On October 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) officially added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog. This means there is concrete forensic evidence that attackers are actively exploiting this flaw on the internet.
Because this vulnerability originates in Google’s Brotli library, its impact is not limited to Node.js. Other technologies that bundle the affected version of Brotli—such as Bun, Python (Brotli compression packages), and some software gateways—may also be vulnerable to the same type of attack if their applications process compressed data from external sources.
Mitigation: What Should Administrators Do?#
The only definitive way to close this vulnerability is to upgrade the Node.js runtime in use.
- Update Node.js (strongly recommended): Immediately update your Node.js environment to one of the following versions:
- Node.js 26.12.1
- Node.js 24.22.1
- Node.js 22.23.4
(Note: Node.js 20.x and earlier have reached End of Life (EOL) and will not receive this update. Users should migrate to version 22.x or later immediately.)
Review container images (Docker): If you deploy applications using containers, update the instructions in your
Dockerfileto use a patched version tag. Manually pull the image (docker pull) and rebuild it to ensure the system does not mistakenly load a cached image containing an outdated, vulnerable Node.js runtime.Temporary mitigation (workaround): If the application cannot be updated immediately, temporarily disable or restrict web application features that receive or decompress untrusted Brotli data uploads. Administrators are also advised to monitor internet-facing web processes for unusual shell-spawning activity.
