Node2Shell
- Product
- OpenJS Foundation / Google (Brotli) Node.js (bundled Brotli decoder)
- CVE
- CVE-2026-111497
- Disclosed
- 2026-10-21
- CVSS
- —
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Node.js 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1, plus EOL lines (20.x and older, 23.x, 25.x); Google Brotli 1.0.3-1.0.9, 1.1.0, 1.2.0
- Fixed
- Node.js 22.23.4, 24.22.1, 26.12.1; Brotli 1.0.10, 1.1.1, 1.2.1
Summary
An out-of-bounds write in the Brotli decompressor that Node.js bundles can corrupt decoder state when it handles a malformed stream. Reported to Node.js by OpenAI Codex Security; Imperva's red team named it Node2Shell after getting code execution on the official Node.js 24.22.0 Linux arm64 image. The CNA (Google) scores it CVSS v4.0 9.2; Node.js rates it High.
Root cause
In DecodeBlockTypeAndLength, a block switch on a stream with only one block type returned the same 'false' as a temporary need for more input, instead of a format error. The streaming decoder then kept appending input bytes to an eight-byte internal buffer, writing past it into adjacent decoder state (CWE-787, CWE-252). The fix returns the new BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH error. Brotli input reaches node:zlib through paths such as fetch() reading a br-encoded response or Express 5 / body-parser 2 decompressing request bodies; a bare Node.js HTTP server does not decode request bodies on its own.
Impact
Remote code execution in Node.js services that decompress attacker-controlled Brotli data; exploitability depends on build and environment (CVSS AT:P).
Detection
Check node --version across hosts and container images; look for crashes in services receiving Content-Encoding: br request bodies or fetching untrusted URLs.
Mitigation
Upgrade Node.js to a fixed release (move off EOL lines); until then, reject br-encoded request bodies at the proxy or app layer.