CVE-2026-111497Node2Shell / HTTP2Shell / Broccoli2Shell: Brotli decoder out-of-bounds write (CVE-2026-111497)

Executive summary

CVE-2026-111497 is an out-of-bounds write in the decoder of Google's Brotli compression library, bundled in Node.js and many other runtimes and proxies. According to the Node.js advisory of 2026-10-21, the decoder reported an invalid block switch as a temporary need for more input instead of a format error, so the streaming decoder kept appending bytes past the end of an eight-byte internal buffer. An attacker who can get Brotli data decompressed by node:zlib can cause a crash, disclose process memory or achieve remote code execution. Node.js credits OpenAI Codex Security, Khai Tran and Sylvie Mayer. The bug is also called Node2Shell, HTTP2Shell, Broccoli2Shell and Brotli2Shell.

Fixes shipped on 2026-10-21 in Node.js 22.23.4, 24.22.1 and 26.12.1 and in Brotli 1.0.10, 1.1.1 and 1.2.1. End-of-life Node.js lines (20.x, 23.x, 25.x) receive no fix. Tenable lists further affected consumers, including .NET (updates on 2026-10-25), Bun, Envoy, Istio, the Python Brotli bindings and PHP Windows builds. Palo Alto Networks (PAN-OS dataplane Brotli inspection) and Broadcom (SDDC Manager in VMware Cloud Foundation) published product advisories.

CISA added the CVE to KEV on 2026-10-27. ELLIO and Previdian report exploitation attempts against their sensors, and Imperva and ELLIO reproduced code execution on specific official Node.js 24.22.0 builds. Public reporting so far shows attempts and lab RCE, not confirmed production compromises.

Threat assessment

Exposure depends on whether attacker-controlled Brotli data reaches a vulnerable decoder: inbound request bodies with Content-Encoding: br that a body parser decompresses (Imperva names Express 5 and body-parser 2 with Brotli parsing enabled), or outbound fetches whose Brotli-compressed responses are decoded (for example Node.js fetch()). Imperva notes that a bare Node.js HTTP server does not decode incoming Brotli bodies just by receiving them. Rapid7 is cited by Help Net Security as saying exposure depends on processing attacker-controlled Brotli data.

Reliable code execution is build-specific. ELLIO reports that its exploit needs a target-specific offset per build, worked against Node.js 24.22.0 on x86-64 but failed in 10,000 attempts against 22.23.3 and 26.12.0, and that most failed attempts crash the worker. The in-the-wild request ELLIO captured on 2026-10-26 produced no shell in 50 lab attempts. Crash loops are therefore the most likely visible effect of attempts, with denial of service as a realistic impact even where RCE fails.

Severity ratings differ by source: Google as CNA scores CVSS v4.0 9.2, Microsoft rates the .NET impact CVSS v3.1 8.1, and Node.js rates it High. Given KEV listing, public PoCs, observed scanning and the breadth of embedded Brotli copies (container images, compiled Bun binaries, vendored libraries), prioritise internet-facing services that decompress untrusted Brotli data.

Timeline

1. 2026-11-07

   Previdian sensors record their latest attempt; total 24 attempts from 10 IPs since 2026-10-27, success not established. Source

2. 2026-10-28

   Tenable updates its FAQ with ELLIO and Imperva exploitation reliability research. Source

3. 2026-10-27

   CISA adds CVE-2026-111497 to the KEV catalog, due date 2026-11-10. Source

4. 2026-10-26

   ELLIO reports an in-the-wild exploit request against Node.js 24.22.0 on x86-64. Source

5. 2026-10-26

   Palo Alto Networks publishes its PAN-OS advisory for dataplane Brotli inspection; no known malicious exploitation. Source

6. 2026-10-26

   PHP publishes updated Windows builds 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 with Brotli 1.2.1. Source

7. 2026-10-25

   Microsoft releases .NET security updates 8.0.33, 9.0.22 and 10.0.14. Source

8. 2026-10-22

   Imperva publishes a demonstration of code execution on the official Node.js 24.22.0 Linux arm64 image; a public PoC also appears. Source

9. 2026-10-21

   Node.js releases 22.23.4, 24.22.1 and 26.12.1; Google releases Brotli 1.0.10, 1.1.1 and 1.2.1. Source

10. 2026-02-27

    Upstream fix committed to google/brotli without release or advisory. Source

Affected & exposure

Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1 (Node.js advisory)

Node.js 20.x, 23.x, 25.x (end-of-life, no fix; Tenable, Help Net Security)

Google Brotli 1.0.3 to 1.0.9, 1.1.0, 1.2.0; fixed in 1.0.10, 1.1.1, 1.2.1 (Tenable)

.NET 8, 9, 10 when Brotli decompression is used; fixed in 8.0.33, 9.0.22, 10.0.14 (Tenable); .NET Framework not affected

Bun 1.0.21 to before 1.4.4; Envoy fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0; Istio fixed in 1.29.9, 1.30.6, 1.31.2 (Tenable)

Python Brotli up to 1.2.0 (fixed 1.2.1) and brotlicffi up to 1.2.0.x (fixed 1.2.1.0); PHP Windows builds fixed in 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 (Tenable, php.net)

PAN-OS 12.2 below 12.2.4-h1, 12.1 below 12.1.4-h13/12.1.7-h11/12.1.10-h3, 11.2 below 11.2.4-h23/11.2.7-h23/11.2.10-h17/11.2.13-h4/11.2.16-h1, only with dataplane Brotli inspection and TLS decryption; management interface, Panorama, 11.1 and 10.2 not affected (Palo Alto Networks)

VMware SDDC Manager in VCF 9.1.1 identified as critically affected (Broadcom KB 460791); SecurityWeek reports lower ratings for 9.0.x, 9.1.0 and 5.2.x with workarounds published

Exploitation in the wild

CISA added CVE-2026-111497 to the KEV catalog on 2026-10-27 as "Google Brotli Unchecked Return Value Vulnerability" (CWE-252, CWE-787), federal due date 2026-11-10.

ELLIO recorded on 2026-10-26 a single Brotli-coded HTTP request body of about 23 MB targeting Node.js 24.22.0 on x86-64 and assessed an operator pursuing mass exploitation; the captured chain produced no shell in ELLIO's lab tests. ELLIO also observed a public exposure checker identifying itself as node2shell-check.

Previdian lists 24 attempts across 16 sensors from 10 unique IPs between 2026-10-27 and 2026-11-07 and states that observations do not show that any attempt succeeded.

Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image (exploit not released); ELLIO reproduced shells on four x86-64 setups using official 24.22.0 binaries.

Datadog Security Labs reports a public PoC appeared on 2026-10-22 that causes a crash and limited memory read on standard builds. Palo Alto Networks states it is not aware of malicious exploitation against PAN-OS.

Detection & hunting

There is no reliable payload signature: WAFs see only compressed bytes and body-size limits count decompressed bytes (Datadog). Hunt instead for Brotli-encoded request bodies to Node.js services, worker crashes (exit code 139 / SIGSEGV) shortly after Brotli transfers, decoder errors, the node2shell-check user agent named by ELLIO, and shells or new outbound connections spawned by node processes.

index=web (sourcetype=*access* OR sourcetype=*proxy* OR sourcetype=*waf*) http_method IN ("POST","PUT","PATCH")
| eval ce=lower(coalesce(content_encoding, http_content_encoding, 'request_headers.content-encoding'))
| where ce="br" OR like(lower(http_user_agent), "%node2shell%")
| stats count AS requests max(bytes_in) AS max_bytes_in values(uri_path) AS paths values(status) AS statuses BY src_ip dest_host
| sort - max_bytes_in

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("node", "node.exe", "bun", "bun.exe")
| where FileName in~ ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe", "curl", "wget", "nc", "ncat", "python", "python3", "perl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

index=* (sourcetype=kube:* OR sourcetype=docker* OR sourcetype=syslog OR sourcetype=journald)
("exit code 139" OR "exitCode=139" OR "SIGSEGV" OR "segfault") (node OR nodejs)
| bin _time span=10m
| stats count AS crashes values(host) AS hosts BY _time, container_name
| where crashes >= 3

title: Shell Spawned by Node.js Runtime (possible CVE-2026-111497 exploitation)
status: experimental
description: Detects interactive shells or download tools started by a node or bun process, a post-exploitation signal for Node2Shell and similar RCE.
references:
  - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
  - https://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/bun'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
  condition: selection_parent and selection_child
falsepositives:
  - Build tooling and applications that legitimately call child processes (npm scripts, child_process usage)
level: high
tags:
  - attack.execution
  - attack.t1190
  - cve.2026-111497

Mitigation

• Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later; move 20.x, 23.x and 25.x to a supported line. Rebuild and redeploy container images, since pinned images such as 24.22.0 still ship the vulnerable build (ELLIO, Imperva).
• Inventory all other Brotli consumers and patch them: libbrotli packages, .NET, Bun (rebuild bun build --compile executables), Envoy and Istio, Python Brotli/brotlicffi, Java brotli4j, PHP Windows builds. Patches only take effect after process restart (Tenable).
• PAN-OS: apply the fixed hotfix or disable Brotli inspection ("Allow Brotli Encoding" / set system setting brotli-encoding disable) per the Palo Alto advisory. VMware SDDC Manager: follow Broadcom KB 460791 and the referenced VMSA and workaround KBs.
• Interim: reject inbound requests with Content-Encoding: br at proxies or load balancers where business allows; disable Brotli decoding in HTTP clients (removing br from Accept-Encoding alone is insufficient) and the Envoy/Istio Brotli decompressor filter (Tenable).
• Treat repeated decoder crashes as a potential memory disclosure event; restrict access to and retention of core dumps (ELLIO).

Update log

Sources

1. Node.js: October 2026 Security Releases
2. CISA Known Exploited Vulnerabilities Catalog
3. Palo Alto Networks: CVE-2026-111497 Portfolio Status
4. Broadcom KB 460791: Node.js Brotli decoder vulnerability and VMware by Broadcom product portfolio
5. Tenable: Brotli2Shell FAQ for CVE-2026-111497
6. ELLIO: Node2Shell CVE-2026-111497 RCE on stock Node.js builds
7. Imperva: Node2Shell, from Brotli data to remote code execution
8. Previdian: CVE-2026-111497 exploitation attempts observed
9. Datadog Security Labs: Node2Shell CVE-2026-111497
10. SecurityWeek: CISA warns of Node2Shell exploitation as honeypots log attack attempts