Node2Shell (CVE-2026-111497): Detecting the Node.js Brotli RCE

Node2Shell, tracked as CVE-2026-111497, is a critical out-of-bounds write flaw in the Brotli decoder used by Node.js that can cause crashes and, in limited demonstrated circumstances, remote code execution when applications decompress attacker-controlled Brotli data. Fixed Node.js releases are 22.23.4, 24.22.1, and 26.12.1, while end-of-life releases such as Node.js 20 and 25 receive no fix; exposure may also depend on operating-system packages that use a vulnerable system Brotli library, and Bun versions through 1.4.3 are affected. The vulnerability stems from a malformed compressed stream causing the decoder to ignore an error and write beyond a buffer, with reachable paths including Express 5’s default JSON parsing, server-side fetch requests to attacker-controlled servers, direct zlib Brotli use, and several other frameworks and middleware. Public research has readily reproduced denial-of-service crashes, while code execution has been demonstrated on a specific Linux arm64 Node.js image but is not yet established as reliable across platforms, and no confirmed in-the-wild exploitation was reported at publication. Recommended actions include inventorying Node.js and Brotli deployments, prioritizing systems that process untrusted Brotli content, patching runtimes and container images, disabling or rejecting Brotli request decompression where feasible, reviewing untrusted fetch destinations, applying least-privilege configurations, and monitoring for process crashes followed by shell execution or suspicious outbound activity.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.