Node2Shell Remote Code Execution (CVE-2026-111497)

Node.js has patched CVE-2026-111497, an out-of-bounds write in its Brotli decoder that can potentially allow remote code execution (RCE). The CVE record rates it critical (CVSS 3.1: 9.8, CVSS 4.0: 9.2), although the Node.js advisory classifies it as High.

Update to Node.js 26.12.1, 24.22.1 or 22.23.4, or a newer patched release in the same branch. Applications using Express 5, body-parser 2.x, fetch() or the node:zlib Brotli APIs should review their exposure immediately.

Exploitation Status

Imperva published research on 22 October 2026 reporting code execution against the official Node.js 24.22.0 Linux arm64 image, though the exploit needed multiple attempts to succeed. Imperva has not released its exploit code. Additional proof-of-concept code has appeared publicly; the reliability and demonstrated impact vary.

Depending on the input and execution path, the vulnerability can cause a process crash or memory corruption and may permit memory disclosure or arbitrary code execution.

As of 23 October 2026, we are not aware of confirmed exploitation in the wild. This does not rule out unreported attacks. Because proof-of-concept code is public, and Imperva has shown that code execution is achievable, we recommend patching as a priority.

We are not linking to any exploit code.

Who Is Affected

You are affected if you run an affected Node.js version and your application decompresses Brotli data that an attacker can control. Common attack paths include:

• Express 5 and body-parser 2.x: applications using body parsers that accept Brotli-compressed request bodies automatically decompress requests marked Content-Encoding: br.
• Outbound requests: Node.js's built-in fetch() automatically decompresses supported compressed HTTP responses. A hostile or compromised upstream server could therefore supply attacker-controlled Brotli data. Pay particular attention to requests involving untrusted hosts or URLs supplied by users.
• Direct use of node:zlib: any code or dependency passing untrusted input to the Brotli decompression functions.

Bun is also affected in versions before 1.4.4.

Affected and Fixed Versions

Node.js installed through an operating system package manager is sometimes built against the OS-provided Brotli instead of its own copy.

In that case, node --version may not tell you whether you are protected. Instead, update the operating system's Brotli package and follow your distribution's security notices. Upstream Brotli 1.0.3 to 1.2.0 is affected and 1.0.10, 1.1.1 and 1.2.1 contain the fix, but distributions may backport it without changing the version number.

How to Check Whether You Are Affected

Start by checking the Node.js version on your hosts, CI runners and deployed containers:

node --version

For a built image, check the runtime inside the image rather than relying solely on your package inventory:

docker run --rm --entrypoint node your-image:tag --version

Or on a container directly:

docker exec my-container node --version

Identify applications that decompress untrusted Brotli data. Review Express and body-parser configurations, outbound fetch() calls to untrusted or user-supplied URLs, and direct calls to Brotli decompression functions in node:zlib.

Repeat these checks across production services, scheduled jobs, serverless functions, and build environments. After patching, verify the runtime version in the deployed workload and not just in the source repository or Dockerfile.

Mitigation

Updating the runtime is the only complete fix. For Bun, that means upgrading to 1.4.4 or later. For distribution-built Node.js, it means updating the system Brotli package.

• Apply the update: upgrade to a fixed release in your branch, prioritising internet-facing services and anything that fetches data from external URLs.
• Rebuild containers: rebuilding alone is not enough if the base image is fixed to an old version such as node:24.22.0. Change the tag to a patched release, then rebuild and redeploy.
• Check managed platforms: if a hosting provider or serverless platform supplies Node.js for you, confirm which version it is running, as providers do not always update immediately.
• Plan to migrate end-of-life versions: Node.js 25.x, 23.x, 20.x and older are out of support and no patch is planned for them.

Stop-Gap Mitigations

Node.js has not published an official workaround. Restricting Brotli-compressed request bodies before they reach Node.js narrows the inbound attack surface. It does not protect data your application fetches itself, such as fetch() responses, and is not a substitute for patching. Ensure you test these changes before deploying to production.

Express

With Express, inbound request filtering can be applied to restrict the Brotli encoding from client requests.

Register this before any body parsers:

app.use((req, res, next) => {
  if (/\bbr\b/i.test(req.headers['content-encoding'] || '')) {
    return res.status(415).send('Unsupported Content-Encoding');
  }
  next();
});

References

• Node.js: October 2026 Security Releases
• Tenable: CVE-2026-111497
• Node.js v22.23.4 release notes
• Imperva: Node2Shell, From Brotli Data to Remote Code Execution
• Aikido: Node2Shell
• Bun v1.4.4 release notes

Adam Govier Founder & Lead Consultant

OSCP OSCE

Adam founded Exploitr and leads its penetration testing practice. He holds OSCP and OSCE certifications and has over 12 years' experience in penetration testing and security consulting.