Node2Shell: Node.js Brotli Flaw CVE-2026-111497 Can Allow Remote Code Execution, Upgrade to 22.23.4, 24.22.1 or 26.12.1

On 21 October 2026, the Node.js project released 22.23.4, 24.22.1 and 26.12.1 for all three supported release lines. The most serious fix is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js bundles. Node.js says the flaw "permits remote code execution" and rates it High. The CVE record comes from Google, the CNA for the Brotli library. Google gives it a CVSS 4.0 score of 9.2 (labelled Critical on NVD), and NVD has not yet published its own assessment ("Awaiting Analysis"). Imperva's Red Team calls its analysis of the flaw "Node2Shell".

A Node.js service is exposed only if it, or a library it uses, decompresses Brotli data that an attacker controls. Imperva tested two such routes: Node.js's built-in fetch() reading a Brotli-compressed response, and Express 5 or body-parser 2 decoding a Brotli-compressed request body. Several facts put the risk in context. Node.js rates the flaw High, not Critical. Imperva says code execution "took multiple attempts" in its own lab. As of 23 October 2026, 08:26 Cyprus time (UTC+3), no source we checked reports exploitation in the wild, CISA's Known Exploited Vulnerabilities (KEV) catalog does not list the CVE, and fixed versions are available. Node.js 20.x and older are end of life and will not get a fix.

Technical Information

What Node.js says (Node.js security release, 21 October 2026):

• "Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)". It affects the 26.x, 24.x and 22.x lines.
• Node.js credits "OpenAI Codex Security - Khai Tran and Sylvie Mayer" with the report, and Node.js maintainers Matteo Collina and Antoine du Hamel with the fix.
• "End-of-Life versions are always affected when a security release occurs."
• The release notes show the fix as a cherry-pick of an upstream Brotli commit, plus a new decoder error code (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) that patched Node.js returns when it rejects an invalid stream (Node.js 24.22.1 release notes).

What the CVE record says. Google's record on cve.org describes a buffer overflow in the Brotli decoder in Google Brotli 1.0.3 through 1.2.0 that "allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream." Its CVSS 4.0 vector requires no privileges or user interaction, but it marks attack requirements as present (AT:P), which means the attack depends on conditions in the target's setup. The weaknesses listed are CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value). Google released Brotli 1.0.10, 1.1.1 and 1.2.1 with the fix (Brotli 1.2.1 release). That matters beyond Node.js: other software that bundles an affected Brotli version may need its own update.

How the decoder is reached. Node.js does not decode Brotli on its own. Vercel puts it this way: "Your application is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls, whether in a request body or in a response it fetches" (Vercel bulletin). Imperva tested two routes (Imperva, 22 October 2026):

• Responses a service fetches. Node.js's built-in fetch() consuming a Brotli-compressed response from another server.
• Request bodies a service receives. Express 5.0.0–5.3.0 and body-parser 2.0.0–2.3.0, using the raw() and json() parsers. Imperva notes that "the vulnerable code is in Node.js: these middleware versions identify paths that can invoke it," and that "a bare Node.js HTTP server does not decode incoming Brotli bodies simply by receiving them."

How far exploitation has been shown. Imperva says its proof of concept ran code supplied in Brotli data inside test applications on the official Node.js 24.22.0 Linux arm64 image, and that 24.22.1 rejected the same inputs. It adds that "execution took multiple attempts in our setup" and that it "did not test every Node.js build or application." Imperva has not said it published its proof of concept. The Hacker News reports that a separate public proof of concept, published on 22 October, "reached code execution only against a deliberately weakened test build," and that on a standard Node.js build its author reported a crash and a limited read of process memory, not code execution. We do not link proof-of-concept code.

Exploitation status. CISA's assessment attached to the NVD record (22 October, 17:15 Cyprus time) lists exploitation as "none", automatable as "no" and technical impact as "total" (NVD). The CVE is not in the KEV catalog (see Sources for the check time). Neither Node.js nor any national CERT we checked reports attacks.

Other fixes in the same release. The release fixes nine more CVEs and updates bundled dependencies (c-ares, OpenSSL, SQLite, undici and the root certificate store). The ones most relevant to suppliers that make outbound TLS connections:

The same release also blocks the compromised eMudhra intermediate CA keys, which we covered in our eMudhra intermediate CA key compromise advisory.

Timeline (times in Cyprus time, UTC+3, where the source gives one):

• 21 October 2026: Node.js publishes the security release and ships 22.23.4, 24.22.1 and 26.12.1. Vercel says it deployed WAF rules for inbound traffic the same day.
• 21 October, 22:27: Google publishes Brotli 1.0.10, 1.1.1 and 1.2.1 on GitHub, each listing CVE-2026-111497 under "SECURITY".
• 22 October, 16:35: Google publishes the CVE record (CVSS 4.0: 9.2).
• 22 October, 17:15–17:17: The record reaches NVD ("Awaiting Analysis"), with CISA's assessment of no known exploitation.
• 22 October: Imperva publishes "Node2Shell: From Brotli Data to Remote Code Execution". France's CERT-FR publishes CERTFR-2026-AVI-1367, and Hong Kong's GovCERT.HK publishes High Threat Security Alert A26-10-37. GovCERT.HK says "reports indicate that proof-of-concept (PoC) exploit code is available for the vulnerabilities."

Affected Product Versions

Per the Node.js security release and release notes (21 October 2026) and the Node.js release schedule.

Per Google's CVE record, the underlying library is affected in Google Brotli 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. The fixed library versions are 1.0.10, 1.1.1 and 1.2.1.

Notes (Rescana guidance):

• Bundled runtimes. Containers, serverless images, desktop apps and CLI tools often ship their own Node.js binary. Imperva warns that "a package inventory can miss an older runtime bundled in a container."
• Updating npm packages is not enough. The flaw is in the Node.js runtime, so updating Express, body-parser or other npm packages does not fix it. Only a fixed Node.js release does.
• Exposure is not compromise. Running an affected version only matters where the service decompresses untrusted Brotli data.

Workaround and Mitigation

1. Upgrade Node.js. Move every runtime to 22.23.4, 24.22.1, 26.12.1 or later. Imperva advises including "container images and other artifacts that bundle a Node binary," and checking "the Node.js version inside each deployed image or host." Vercel's advice covers "external backends, self-hosted Next.js, container images you build yourself, CI runners and local development."

2. Move off end-of-life lines. Node.js 20.x and older, and 23.x and 25.x, receive no fix. Vercel tells customers that "Node.js 20 reached end of life and will not receive this fix," and asks projects still on 20.x to switch to 22.x or 24.x and redeploy.

3. Until you can upgrade, reduce untrusted Brotli input. Imperva suggests that, "where practical, temporarily limit untrusted Brotli traffic on affected paths while updates roll out," and test against normal traffic. For services that do not need compressed request bodies, body-parser documents an inflate: false option that "rejects encoded requests before any decompression stream is created" (body-parser advisory GHSA-27r3-jxmh-p828). This only covers inbound bodies. Vercel notes that "only the runtime patch covers fetched responses."

4. Treat WAF rules as a stopgap. Imperva and Vercel both say they have added WAF rules. Vercel says its rules do not cover "responses your functions fetch from other servers" and that the WAF "does not replace patching."

Express and body-parser. Neither project has published an advisory for CVE-2026-111497. Express's security advisories list has no new entry, and its latest release (5.3.0, 9 October) predates the Node.js fix. On 22 October, body-parser did publish a separate advisory, GHSA-27r3-jxmh-p828 (CVE-2026-111181, which body-parser rates High at CVSS 3.1 7.5). It covers a denial of service from trailing bytes after a compressed request body and is fixed in body-parser 2.4.0 and 1.20.9. That advisory is not about the Brotli decoder flaw, but it affects the same compressed-body path, so it is worth applying at the same time.

Indicators of Compromise

Node.js, Google, Imperva, Vercel, CERT-FR and GovCERT.HK have published no indicators of compromise for CVE-2026-111497, and we have none to add. Imperva says "unexpected process exits during decompression and decoder errors may help prioritize investigation," but "neither is a reliable stand-alone sign of exploitation." It suggests correlating them with the deployed runtime, application logs and the source of the compressed data. None of the sources maps the flaw to MITRE ATT&CK, and we have not done so either.

What we will update

We will update this post if CISA adds CVE-2026-111497 to the KEV catalog, if Node.js, Google, CISA or a national CERT reports exploitation in the wild, if NVD publishes its own score, or if Express or body-parser publish guidance on the Brotli flaw.

Sources

• Node.js: "Wednesday, October 21, 2026 Security Releases": https://nodejs.org/en/blog/vulnerability/october-2026-security-releases; release notes for 22.23.4, 24.22.1 and 26.12.1; release schedule and end-of-life dates (Node.js Release working group): https://github.com/nodejs/Release
• Google (CNA) and the Brotli project: CVE-2026-111497 record: https://www.cve.org/CVERecord?id=CVE-2026-111497; Brotli 1.2.1 release: https://github.com/google/brotli/releases/tag/v1.2.1
• NVD and CISA: NVD, CVE-2026-111497 (Awaiting Analysis; CISA assessment attached): https://nvd.nist.gov/vuln/detail/CVE-2026-111497; CISA, Known Exploited Vulnerabilities catalog (checked 23 October 2026, 08:26 Cyprus time; catalog version 2026.10.21): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• National CERTs: CERT-FR, CERTFR-2026-AVI-1367 (22 October 2026, French): https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1367/; GovCERT.HK, High Threat Security Alert A26-10-37 (22 October 2026): https://www.govcert.gov.hk/en/alerts_detail.php?id=2126
• Express project: body-parser advisory GHSA-27r3-jxmh-p828 (22 October 2026): https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828; Express security advisories: https://github.com/expressjs/express/security/advisories
• Security vendors and press: Imperva, Ron Masas, "Node2Shell: From Brotli Data to Remote Code Execution" (22 October 2026): https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/; Vercel, "Node.js security advisory: Brotli decoder RCE (CVE-2026-111497)": https://vercel.com/kb/bulletin/node-js-security-advisory; The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions" (22 October 2026): https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html

Node.js runs the APIs, web backends and integration services of a large share of SaaS suppliers, often inside container images that are rebuilt less often than application code. Whether a supplier can tell you quickly which Node.js runtime it runs, and where it decompresses data from outside, is a good test of how well it knows its own stack.

Forward this to your TPRM owner: Send your key SaaS suppliers a short, friendly check this week (Rescana guidance):

• Are your production services, container images and build agents on Node.js 22.23.4, 24.22.1, 26.12.1 or later? If not, when do you plan to upgrade?
• Do you still run Node.js 20.x or another end-of-life line anywhere, including bundled runtimes? What is your plan to move off it?
• Do any of your services decompress Brotli data from untrusted sources, such as compressed request bodies (for example through Express 5 or body-parser 2) or responses fetched from third-party servers? What interim controls are in place until the upgrade is complete?

Want a fast, evidence-based view of how your suppliers handle runtime fixes like this one? Book a demo.