Node2Shell: the Brotli bug reaches beyond Node

When Node.js shipped ten security fixes on 21 October, one stood out: a write past the end of a buffer in the Brotli decoder. Since then the story has grown. The bug (CVE-2026-111497, nicknamed Node2Shell) is not really a Node.js bug. It is a bug in the Brotli C library that Node happens to bundle, and a lot of other software uses the same code.

What changed since the release

• A proof of concept is public. It appeared on 22 October. Researchers report code execution on an unmodified Node.js 24.22.0 build in lab conditions. It did not work on every attempt, and 24.22.1 rejects the same input.
• No attacks in the wild reported at the time of writing. CISA’s 23 October assessment lists exploitation as none. A public exploit usually changes that quickly.
• The ratings differ. Google scores it 9.2 (critical), Red Hat 8.1, and Node.js calls it high. Pick the strictest and move on.
• It was found by an AI team. OpenAI’s Codex Security researchers reported it; the Node.js fix came from maintainers Matteo Collina and Antoine du Hamel.

Why it reaches so far

Brotli is a compression format that browsers and servers use when a reply is marked Content-Encoding: br. Many projects ship the same decoder, so one flaw becomes many.

When are you actually exposed?

The attacker needs to get you to decompress Brotli data they control. In practice that happens in three ways:

1. A server that decodes request bodies. Express 5 and body-parser 2.x will decode Content-Encoding: br bodies. A bare Node.js HTTP server does not do this on its own.
2. A program that fetches from a hostile or compromised server. fetch() in Node.js and Bun decodes Brotli responses automatically.
3. Code that calls Brotli directly on untrusted input, such as node:zlib Brotli functions.

Python is easy to overlook: HTTP clients like requests and httpx decode Brotli automatically once the Brotli or brotlicffi package is installed, so a scraper or an API client can be exposed. Envoy and Istio are affected only if Brotli decompression is switched on.

What could happen to your code

At minimum, a crafted payload can crash the process, which on its own is a denial of service. Worse, it can leak memory contents, and in the right conditions it can run attacker code as your service, with the same files, environment variables and network reach as your app. Treat anything that talks to the public internet and uses Brotli as a front-line risk.

What to do, in order

1. Find every runtime. Run node -v and bun -v on servers, in CI and inside container images. For Python, pip show Brotli brotlicffi in each environment. For proxies, check the Envoy or Istio version.
2. Upgrade to the fixed version (see the figure): Node.js 22.23.4, 24.22.1 or 26.12.1; Bun 1.4.4; Python Brotli 1.2.1 and brotlicffi 1.2.1.0; Envoy and Istio per your branch. If you are on Node.js 25, 23, 20 or older, those lines are end of life and get no fix: move to a supported line.
3. Rebuild and redeploy images, then restart processes. A patched host does nothing for a container that still carries the old runtime.
4. If you cannot upgrade today, reject Content-Encoding: br request bodies at your proxy or load balancer. This does not protect Brotli responses your own code fetches from other servers, and Node.js lists no workaround, so it is only a stopgap. Edit the config with vim, reload, and test.
5. Check distro packages. Distribution builds of Node may use the system Brotli library, in which case the fix arrives as a distro update.
6. Reduce the blast radius. Run services as low-privilege users, keep secrets out of the process environment where you can, and restrict outbound network access so a compromised service cannot reach everything.

Sources

The Hacker News, Aikido’s write-up and the Node.js security release notes. Check the vendor advisory for your product’s exact version.