Node2Shell: a Brotli-compressed body is enough to corrupt Node.js memory
Published
On 21 October 2026, Node.js shipped a security release for every maintained line. Among other fixes, it addresses CVE-2026-111497, nicknamed Node2Shell: an out-of-bounds write in Google’s Brotli library, which Node.js bundles for decompression. Crafted Brotli data can crash the process, make it leak memory, or run code inside it. A public proof-of-concept exists.
Fixed: Node.js 22.23.4, 24.22.1 and 26.12.1 (21 October 2026)
Where does the Node2Shell flaw come from?
The Brotli decoder treats an invalid block switch as a simple shortage of input instead of a format error. In streaming mode it then keeps appending bytes to an eight-byte internal buffer, and ends up writing past it. The Node.js process memory gets corrupted.
The flaw is in Brotli itself, not in Node.js code. Any software bundling the same decoder is affected: Bun, the Python `Brotli` and `brotlicffi` packages, .NET, Envoy and Istio, brotli4j, plus Linux distribution packages.
Is my Node.js API exposed?
If it runs on Express 5 or body-parser 2, very likely: those versions decompress request bodies sent with `Content-Encoding: br` by default. Any client can therefore send crafted Brotli data to your API.
Also exposed: code that passes untrusted data to `zlib.brotliDecompress()` or `zlib.createBrotliDecompress()`, and the built-in `fetch()`, which automatically decompresses Brotli responses, so a malicious or compromised server your application calls can attack it. A bare Node.js HTTP server, on the other hand, does not decode compressed bodies on its own.
Is it being exploited?
As of 26 October 2026, Rapid7 knows of no exploitation in the wild, and the flaw is not in CISA’s Known Exploited Vulnerabilities catalog. But Imperva researchers demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, even if their exploit does not succeed on every attempt.
Node.js rates the flaw High; Google, which maintains Brotli, scores it 9.2 in CVSS v4. With a public proof-of-concept, the window before real attacks is counted in days.
What should you do today?
Move to Node.js 22.23.4, 24.22.1 or 26.12.1, then restart processes and rebuild container images: a running process keeps the old decoder until it exits. End-of-life lines (25.x, 23.x, 20.x and older) will get no fix.
If your API does not need to receive compressed bodies, turn them off: with body-parser, `inflate: false` makes those requests fail with a 415.
Check your other components that bundle Brotli too (Envoy proxy, Python or .NET services): updating Node.js does not fix them.
Who is affected?
- Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1
- End-of-life lines (25.x, 23.x, 20.x and older): vulnerable, no fix
- Express 5 and body-parser 2 with default decompression (`inflate: true`)
- Google Brotli 1.0.3 to 1.0.9, 1.1.0 and 1.2.0, and the software bundling it (Bun, Envoy, Istio, .NET, Python, brotli4j)
- Public proof-of-concept; no known exploitation in the wild as of 26 October 2026
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch at the edge: requests whose body is Brotli-compressed (`Content-Encoding: br`) are refused before they reach Node.js. Browsers do not send compressed bodies: the rule does not get in your visitors’ way, and exceptions remain possible route by route.
- ✓Protection covers every Node.js application behind the server (Express, APIs, back office), without touching their code or redeploying them.
- ✓What an edge filter cannot do: protect an outbound `fetch()` to a malicious server, or the decompression of files already stored. For those, only updating Node.js fixes it.
- ✓Attempts are logged and reported to your console: you see who sends Brotli bodies to your API, and when.
Sources
- Rapid7 - CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
- Akamai - Inside Node2Shell: A Closer Look at CVE-2026-111497
- The Hacker News - Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.