> Node2Shell puts Microsoft and Node.js on Brotli patch duty

A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. Tracked as CVE-2026-111497, the high-severity flaw was first flagged in the Brotli decoder bundled with Node.js. The issue stems from an out-of-bounds write that can corrupt process memory, potentially leading to remote code execution (RCE), information disclosure, or denial of service (DoS). The Node.js project disclosed the vulnerability on October 21, 2026, alongside security updates for its 22.x, 24.x, and 26.x release lines. The exposure, however, extended beyond Node.js, forcing Microsoft to release out-of-band security updates for.NET on October 25 to address the same CVE in its Brotli decompression implementation. Separate research published by OpenSourceMalware identified the vulnerable decoder code in the Python packages Brotli and brotlicffi. Both packages have since received patched releases. The risk depends on whether an application uses an affected decoder to process attacker-controlled Brotli data. Remote code execution was demonstrated in a public GitHub proof-of-concept (PoC) lab and independently by cybersecurity firm Imperva, which gave the vulnerability its Node2Shell name. Services that decompress untrusted HTTP responses or request bodies are particularly exposed. Organizations must also account for runtimes and libraries bundled into containers and deployed application artefacts, the researchers noted. A bad block switch sends Brotli decoding out of bounds Brotli is a lossless compression algorithm used to reduce the size of data exchanged between applications and servers. Node2Shell originates in the decoder’s handling of an invalid block-type transition in a compressed stream. According to the GitHub PoC, the vulnerable DecodeBlockTypeAndLength() function can return an ambiguous failure value when a stream requests an invalid block switch. The decoder’s fast path fails to handle that return value properly, allowing processing to continue with an invalid internal state. The resulting out-of-bounds write can corrupt memory. The weakness combines an unchecked return value (CWE-252) with an out-of-bounds write (CWE-787). The PoC targets a vulnerable Node.js 24.22.0 Linux x86-64 build. Its exploit relies on a specific binary and memory layout, and execution is probabilistic, requiring retries in some cases. The repository also demonstrates that the same request fails against the patched Node.js 24.22.1. build, whose decoder rejects the invalid block switch. The flaw was discovered during security testing by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer, who reported the flaw to the Node.js project. Node.js, Microsoft, and Python patches close the gap The Node.js project released fixes in versions 22.23.4, 24.22.1, and 26.12.1. Administrators should upgrade to the relevant fixed release or a later security update, rebuild affected container images, and redeploy applications that bundle vulnerable runtimes. End-of-life Node.js versions should also be treated as affected and migrated to supported releases. Microsoft’s October 25 out-of-band updates address CVE-2026-111497 in .NET 8,9 and 10, as well as .NET 11 Release Candidate 3. The corresponding runtime versions are 8.0.33,9.0.22 and 10.0.14, with 11.0.0-rc.3.26522.148 for the preview line. Updated SDKs are also available. Applications using self-contained deployments or Native AOT must be rebuilt and redeployed where necessary, as updating a shared runtime alone will not replace a decoder already linked into an executable. Python maintainers have also released fixes for the affected packages. OpenSourceMalware identified Brotli 1.2.1 and brotlicffi 1.2.1.0 as patched releases, replacing vulnerable versions up to 1.2.0 and 1.2.0.2, respectively. Developers should update dependencies and verify that deployed environments use the fixed versions. Google also released patched versions of its Brotli library, fixing the underlying flaw in versions 1.0.10, 1.1.1, and 1.2.1. As of publication, no exploitation of Node2Shell in the wild had been publicly reported, despite proof-of-concept code being available for days.