Node2Shell: Brotli Decoder RCE Affects Node.js, Bun, PHP and More

A flaw in the Google Brotli decompression library, tracked as CVE-2026-111497, lets malformed
compressed data write past the end of an internal buffer. Any software that unpacks Brotli data from an
attacker can be made to crash, leak memory, or run attacker code without the attacker needing an
account. Because the flawed code is bundled by many products, the problem reaches Node.js, Bun,
PHP on Windows, Microsoft .NET, two Python packages, and Envoy and Istio when Brotli
decompression is turned on. Researchers have shown remote code execution on Node.js, which they
call Node2Shell, but no real-world attacks have been reported. Updating each affected product is the
fix.

1. Vulnerability Details

CVE ID- CVE-2026-111497
CVSS SCORE- 8.1
EXPLOIT STATUS- No confirmed in-the-wild exploitation; researcher proof of concept (Node2Shell) demonstrated,
not released.

The bug is in the Brotli decoder, not in any single application. An invalid block switch was reported as a temporary need
for more input instead of a permanent format error, so the streaming decoder kept appending input bytes past the end of
an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses can corrupt
process memory, which can lead to a crash, disclosure of process memory, or remote code execution with the privileges
of the affected process. Red Hat and Microsoft both score it 8.1 on CVSS 4.0, and Node.js rates it high; there is no single
NVD base score. An application is exposed whenever its code or a library it uses decompresses attacker-controlled
Brotli, in a request body, a fetched response, or a file.

2. Affected Products & Fixed Versions

3. Observed Activity

• Node2Shell demonstration (Imperva): Researchers demonstrated unauthenticated remote code execution on unpatched Node.js 22.x, 24.x and 26.x, delivering the crafted Brotli data both as a response the application fetched and as an Express request body. The exploit took several tries, has not been released, and was not tested on other builds.
• No in-the-wild activity: CISA’s 23 October assessment recorded exploitation as none and automation as no, and Red Hat reported no reliable public proof of concept for code execution. OpenAI’s Codex Security team reported the flaw; Google fixed upstream Brotli on 21 October.
• Hidden exposure paths In Python, merely installing the Brotli or brotlicffi package exposes HTTP clients such as requests, urllib3, httpx and aiohttp, which decode Brotli responses on their own. PHP rebuilt its Windows packages on 26 October because the 21 October builds bundled the affected Brotli 1.2.0, reachable through the cURL extension.

4. Recommendations

• Patch every affected component to the fixed versions: Google Brotli 1.0.10 / 1.1.1 / 1.2.1, Node.js 22.23.4 / 24.22.1 / 26.12.1, Bun 1.4.4, Envoy 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8, Istio 1.29.9 / 1.30.6 / 1.31.2, and move off end-of-life lines such as Node.js 20 and Istio 1.29. Updating application code or plugins alone does not fix this.
• Where you cannot patch at once, disable Brotli decompression of untrusted data while keeping gzip and deflate: reject inbound requests carrying Content-Encoding: br before any proxy or body parser, and turn off automatic Brotli decoding in HTTP clients. Removing br from the Accept-Encoding header alone does not stop a server from sending it.
• In Python, uninstall the Brotli and brotlicffi packages so requests, urllib3, httpx and aiohttp fall back to gzip and deflate, and check installed versions by hand, since Dependabot and the GitHub advisory may not yet flag them (track PYSEC-2026-4322 and PYSEC-2026-4323).
• On PHP for Windows, install the rebuilt 8.2.35-1, 8.3.36-1, 8.4.27-1 or 8.5.12-1 packages (php -v is unchanged, so the -1 in the filename and the SHA-256 on the downloads page identify the new build), and turn off automatic Brotli decompression in cURL and Guzzle until done.
• Inventory every path that decodes attacker-controlled Brotli, including request bodies, fetched responses, files, and Envoy or Istio filters, and disable those decompressor filters for both requests and responses where Brotli is not needed; Vercel-hosted projects should redeploy to activate runtime protection and keep the Vercel WAF on as defence in depth, not a patch substitute.

5. Sources

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/
• https://patchtheplanet.org/brotli
• https://vercel.com/kb/bulletin/node-js-security-advisory
• https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
• https://thehackernews.com/2026/10/php-issues-second-windows-security.html

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.