Brotli decoder flaw CVE-2026-111497 can enable RCE in Node.js and .NET
Original title: Node2Shell puts Microsoft and Node.js on Brotli patch duty
Public PoCs show memory corruption on unpatched Node.js 24.22.0; no in-the-wild Node2Shell attacks were reported as of publication.
An out-of-bounds write in Google’s Brotli decoder, CVE-2026-111497, can corrupt memory when an application decodes attacker-controlled compressed data, with possible remote code execution, information disclosure, or denial of service. Node.js disclosed it on October 21 and shipped fixes for the 22.x, 24.x, and 26.x lines. Microsoft issued October 25 out-of-band .NET updates, and patched Python Brotli, brotlicffi, and Google Brotli releases are also available. Imperva named the issue Node2Shell after lab demonstrations; OpenAI Codex Security researchers reported it.
Unconfirmed: Lab PoCs show RCE only on a specific binary layout and often need retries; no public in-the-wild exploitation was reported.
- The bug is an unchecked invalid block-type switch plus an out-of-bounds write (CWE-252, CWE-787).
- Node.js fixes are 22.23.4, 24.22.1, and 26.12.1; the PoC fails on 24.22.1.
- Microsoft runtime fixes are 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.26522.148.
- Python Brotli 1.2.1 and brotlicffi 1.2.1.0 replace versions through 1.2.0 and 1.2.0.2.
- Google fixed Brotli in 1.0.10, 1.1.1, and 1.2.1; the Node PoC is probabilistic.
Impact: Remote code execution, disclosure, or denial of service
| Product | Affected | Fixed in |
|---|---|---|
| Node.js | 22.x, 24.x, and 26.x; PoC targets 24.22.0 | 22.23.4, 24.22.1, and 26.12.1 |
| Microsoft .NET | .NET 8, 9, and 10, and .NET 11 Release Candidate 3 | 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.26522.148 |
| Python Brotli | up to 1.2.0 | 1.2.1 |
| Python brotlicffi | up to 1.2.0.2 | 1.2.1.0 |
| Google Brotli | — | 1.0.10, 1.1.1, and 1.2.1 |
- 1.Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1 or later and rebuild bundled images.
- 2.Apply the October 25 .NET updates and rebuild self-contained or Native AOT apps.
- 3.Update Brotli to 1.2.1, brotlicffi to 1.2.1.0, and Google Brotli to a patched release.
- CVEs
- CVE-2026-111497
- Products
- BrotliNode.js.NETbrotlicffi
- Organizations
- ImpervaOpenSourceMalware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at csoonline.com
A vulnerability in Google’s Brotli compression library could allow attackers to execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. Tracked as CVE-2026-111497, the high-severity flaw was first flagged in the Brotli decoder bundled with Node. js.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.