Node2Shell: Node.js Brotli vulnerability allows remote code execution

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.

Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.

The fix: upgrade to the patched Node.js version for your release line

How Aikido helps: Aikido detects the vulnerability and shows you which repositories and container images still run a vulnerable version.

If you run Node.js, assume you are affected until you have checked your version. Every supported release line had the flaw before the October 21 update, and Bun had it too until version 1.4.4.

How exposed you are depends on where your app gets its compressed data. Brotli is a compression format that servers and clients use to shrink web traffic, and the vulnerability can be triggered when Node.js decompresses Brotli data that an attacker controls. That can happen in at least three ways:

The fix is a Node.js upgrade, and it takes four steps:

Managed platforms that bundle their own Node.js runtime can lag behind the upstream release, so check which version your provider runs. If you cannot upgrade today, read the stopgaps below. Bun users should upgrade to Bun 1.4.4 or newer, which includes the fix. The Bun team tracked it in oven-sh/bun issue 46352.

If your Node.js came from a Linux distribution package such as Debian, Ubuntu, Fedora, RHEL, or Alpine, it may use the system Brotli library instead of the copy Node.js bundles. In that case, the fix arrives through your distribution's Brotli package, so check your distribution's security advisory as well as the version number.

Aikido detects this vulnerability and flags the affected Node.js versions in your repositories and container images. Your dashboard shows which services still run a vulnerable runtime, so you can upgrade the ones that call outside servers or accept compressed request bodies first. Once you have upgraded, a fresh Aikido check confirms the finding is gone.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. In plain terms, the decoder can be tricked into writing data past the end of a memory buffer, which is a classic route to crashes and code execution. Node.js rates it high and describes the impact as remote code execution.

Brotli is Google's compression library, and Node.js ships its own copy. The flaw sits in that bundled code, so fixing it means updating the Node.js runtime itself. Node.js runs the decoder whenever it decompresses Brotli data, either directly through the node:zlib module or automatically when fetch() receives a response sent with Brotli compression.

The fix is an upstream patch from the Brotli project, which Node.js cherry-picked (Brotli commit 0ed4268a from February). It makes the decoder detect invalid input and stop before it writes past the buffer. The same fix shipped in Brotli 1.2.1, 1.1.1 and 1.0.10, so other software that bundles Brotli may need an update too.

Node.js rates the flaw as high severity, one step below critical, and the public research has moved fast. A first proof of concept, published on October 22, reached code execution only against a deliberately weakened test build. The same day, security researchers reported code execution against the official, unmodified Node.js 24.22.0 image on Linux arm64, although their exploit did not work on every attempt, and Node.js 24.22.1 rejects the same input. According to The Hacker News, no exploitation in the wild had been reported as of October 22.

Treat it as urgent anyway. The bug is a memory-safety flaw in a runtime component that handles untrusted network input, public proofs of concept exist, and the fix is a routine version bump. Services that call outside servers or accept compressed request bodies should go first.

A Dockerfile pinned to node:24.22.0 stays vulnerable no matter how often you rebuild it. Move the pin to 24.22.1 or later.

The Node.js advisory offers no workaround for the Brotli flaw. These stopgaps reduce exposure while you prepare the upgrade:

Neither stopgap covers Brotli responses that your application fetches from other servers. Only a runtime upgrade removes the flaw, so treat stopgaps as a bridge to it.

Node2Shell is the name circulating online for CVE-2026-111497, the Brotli decoder flaw in Node.js that the Node.js project says can allow remote code execution.

Node.js 22.23.4, 24.22.1 and 26.12.1, plus any newer patch release of those lines. Node.js 25.x, 23.x, 20.x and earlier are end of life and get no fix.

No exploitation in the wild had been reported as of October 22, 2026. Researchers have reported code execution on an unmodified Node.js 24.22.0 build in lab conditions, and the exploit did not work on every attempt.

Yes, if your parser decompresses Brotli request bodies. Express 5 and body-parser 2.x do, so a client can send a crafted Content-Encoding: br request. Upgrading Node.js is the fix.

The Node.js advisory lists none. Rejecting Brotli-encoded requests at the edge reduces inbound exposure, but it does not protect against Brotli responses your app fetches.

Yes, versions before 1.4.4 are affected. Bun 1.4.4 includes the fix, and the Bun team tracked it in oven-sh/bun issue 46352.

https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

4.7/5

Tired of false positives?
 Try Aikido like 100k others.

Start Now

Get a personalized walkthrough

Trusted by 100k+ teams

October 22, 2026

•

Vulnerabilities & Threats

eMudhra CA compromise: eight private keys, and one of them is 4

Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it.

October 21, 2026

•

Vulnerabilities & Threats

LiteLLM compromised again: infostealer and RAT found in version 1.107.0

LiteLLM 1.107.0 contains an infostealer and RAT, and PyPI has quarantined the package. See if you’re affected, what it steals, and what to rotate.

October 21, 2026

•

Vulnerabilities & Threats

PHP2Shell: Critical PHP vulnerabilities, affected versions and fixes

A critical PHP vulnerability lets attackers run code remotely on unpatched servers. See affected versions, patches, mitigations and how to check your exposure. Two PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) are being exploited now. Here’s which versions to update to and what to do if you can’t patch today.

Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.