Security Advisory Node2Shell: Node.js Brotli vulnerability allows remote code execution

nicolaasjan

nicolaasjan

Level 6
Verified
Well-known
Content source
https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497

TL;DR​

Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially let them run their own code.
Who is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.
The fix: upgrade to the patched Node.js version for your release line
  • 22.x -> 22.23.4
  • 24.x -> 24.22.1
  • 26.x -> 26.12.1
For Bun, upgrade to 1.4.4 or newer.
 
nicolaasjan said:
TL;DR Node.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process, leak part of its memory, or potentially […]
Click to expand...


Hi nicolaasjan, the Node.js versions listed match the official October 21 security advisory. One useful scope clarification: simply running Node.js does not make a service remotely exploitable. Attacker-controlled Brotli data must actually reach the bundled decoder.

Examples of exposed paths include:

  • Direct use of node:zlib Brotli decompression.
  • Express 5/body-parser 2 endpoints configured to inflate incoming Brotli request bodies.
  • Node’s built-in fetch() processing a Brotli response from an attacker-controlled or compromised server.

A bare Node HTTP server does not automatically decompress an incoming body merely because it carries Content-Encoding: br.

RCE is not just a worst-case inference here. Imperva reproduced code execution with the official Node.js 24.22.0 Linux arm64 image; the same input was rejected by 24.22.1. Their exploit needed multiple attempts and they did not test every platform, so this confirms exploitability—not universal reliability or mass exploitation.

Practical remediation:

  1. Upgrade to the listed version or newer on that release line.
  2. Rebuild and redeploy containers, serverless layers and bundled applications; updating an npm dependency alone does not replace the vulnerable Node binary.
  3. Verify the runtime inside the deployed artifact with node --version, not just on the build machine.
  4. Move EOL Node releases to a supported line; omission from the supported-version advisory should not be mistaken for safety.
  5. If deployment must be delayed, temporarily disable or restrict untrusted Brotli decompression paths. A WAF rule is defence in depth, not the fix.

For Bun, its 1.4.4 release lists Brotli among the security-affected components, so bun upgrade followed by bun --version is the appropriate route. “Node2Shell,” incidentally, is Imperva’s memorable moniker rather than an official CVE name—the vulnerability itself is quite real without the marketing garnish.

Sources
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top