CVE-2026-111497: the Brotli flaw in Node.js – what is true, what is hype, and how to check in an hour

On 21 October 2026 the Node.js project released 22.23.4, 24.22.1 and 26.12.1 to fix ten CVEs. One of them, CVE-2026-111497, is a flaw in the Brotli decompression library that Node.js bundles. A day later it travelled under the name “Node2Shell”, and headlines of the form “Node.js remote code execution exploit” followed.

The record supports a narrower statement; the difference is an afternoon’s work or an incident.

Everything below comes from the primary records – the CVE entry, the Node.js security release post, the release schedule, the libraries’ documentation and the vendor post that coined the name – re-read on 24 and 25 October 2026.

What was published, and when

The CVE record describes a buffer overflow in the decoder file c/dec/decode.c of Google Brotli 1.0.3 through 1.2.0 on all platforms. A remote, unauthenticated attacker who gets a crafted Brotli-compressed stream decoded can corrupt adjacent decoder state, disclose memory contents, cause a denial of service or potentially execute arbitrary code.

The affected ranges are 1.0.3 to below 1.0.10, 1.1.0 to below 1.1.1 and 1.2.0 to below 1.2.1.

The Node.js post explains the mechanism in one sentence: an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer.

It also names the condition for an attack: “an attacker who can supply Brotli data that an application decompresses with node:zlib”.

What “Node2Shell” means – and does not

“Node2Shell” is, in Imperva’s own words, “Imperva Red Team’s name for our analysis of CVE-2026-111497”, published on 22 October 2026.

The post reports code execution against the official Node.js 24.22.0 Linux arm64 image, states that the proof “did not succeed on every attempt” and that the team “did not test every Node.js build or application”, and says plainly that a bare Node.js HTTP server does not decode incoming Brotli bodies simply by receiving them.

The headlines that carried the name were shorter than that. This is one decoder bug in one library, reachable only where a program feeds Brotli data of an attacker’s choosing into the decoder. A Node.js service that never decompresses anything from outside is running vulnerable code but has no path to it.

The CVSS 4.0 vector says the same in its own notation: AT:P, attack requirements present – something about the deployment has to be true before the attack works.

Who is affected

Three conditions have to hold at once:

1. The runtime bundles an affected Brotli. Node.js 22.x, 24.x and 26.x before the 21 October releases do. So does any other software with its own copy of the library: Python brotli bindings, an nginx Brotli module, download tools.
2. Something decompresses Brotli. Node.js decodes Brotli only when code asks, through node:zlib or a library built on it. The silent case is a web framework’s body parser: the body-parser README states that all its parsers support automatic inflation of gzip, br (brotli), deflate and zstd encodings and that the inflate option defaults to true. An Express API with default settings therefore decompresses a request body that arrives with Content-Encoding: br as soon as the parser runs – if the parser is mounted before the authentication middleware, before any credential is checked.
3. An attacker can choose the bytes. A public listener that accepts request bodies qualifies; so does an application that fetches and decodes responses from servers it does not control.

How to check in an hour

You run these yourself, with the access you already have. Each takes minutes; the hour is for finding every host.

1. Which Brotli does each Node process carry? On every server and in every container run node -p process.versions.brotli. Anything in the affected ranges (1.0.3 to 1.0.9, 1.1.0, 1.2.0) is vulnerable code.
2. Which Node.js line, and is it supported? node -v. Lines 22, 24 and 26 have fixes (22.23.4, 24.22.1, 26.12.1). Line 20 and older have none.
3. Does anything inflate request bodies? npm ls body-parser express in each application. With body-parser present and inflate not set to false, compressed request bodies are inflated by default. Look also for direct zlib.brotliDecompress calls and for HTTP clients that accept Brotli responses from untrusted servers.
4. Does nginx decode Brotli itself? nginx -V 2>&1 | grep -o brotli. No output means nginx has no Brotli module and is not a decoder; it still forwards br bodies to the application.
5. Is Brotli present in other languages? python3 -c 'import brotli'. ModuleNotFoundError is a clean negative; a successful import means that copy needs checking against the same ranges.
6. Write down the negatives. Negative results are findings too; they stop someone patching what is not there.

Running WordPress rather than a Node.js API? Spend the hour on plugin advisories instead.

Mitigation order

The nginx rule is one line in the server block, before proxy_pass:

``nginx if ($http_content_encoding ~* "br") { return 415; } ``

Verify with two requests: with Content-Encoding: br the answer is 415, without it the usual code. Rollback is removing the line and reloading nginx. Before applying it, check whether any of your own clients or integrations send Brotli-compressed request bodies; a rejected legitimate client is the only side effect.

The rule does not cover responses your own application fetches from untrusted servers; that path needs the runtime upgrade.

What we do not know

• Whether reliable code execution exists on standard builds. Imperva reports code execution on one official image (Node.js 24.22.0, Linux arm64), not on every attempt, with no other builds tested; we have not reproduced it. The CVE record says “potentially execute arbitrary code”: a crash or memory disclosure is the documented effect, code execution the demonstrated-once worst case.
• Whether it is being exploited. Not in CISA’s Known Exploited Vulnerabilities catalogue as of version 2026.10.23; CISA’s entry in the CVE record, dated 23 October 2026, gives exploitation “none”; EPSS 0.0071 (53rd percentile) on 24 October 2026. For a CVE two days old these are early signals, not an all-clear.
• Every product that embeds Brotli. Vendors that link the library statically publish advisories at their own pace; the Node.js and operating-system fixes are the known list, not the complete one.

How we handled it

Our Sentinel engine flagged CVE-2026-111497 from the primary feeds and separated record from chatter the way this article does. The checks above are the ones it runs on a host; the four-step order is the one it proposes, edge block first and reversibly, anything that needs a maintenance window left to a person.

That is cybersecurity oversight for companies in the age of AI in practice: one advisory, read at the source, turned into a yes-or-no answer for your systems.

If you want that answer for your own estate, the Northwestern Tideline page explains how an audit works and the enquiry form reaches us directly. We check only what you authorise in writing.