Node2Shell CVE-2026-111497: Brotli Decoder Flaw Affects Multiple Runtimes

Article Details

Attack Vectors

• An attacker can send a crafted Brotli-compressed request body to an exposed service that decompresses request bodies, including Express 5 and body-parser 2.x parsers; parsers mounted before authentication may expose the decoder to unauthenticated requests.
• An attacker can influence a URL fetched by an application and return a Brotli-labeled response that Node.js fetch() or other clients automatically decompress, including when the request asks for identity encoding.
• A crafted Brotli stream can trigger an unchecked copy into adjacent decoder state, enabling memory disclosure or a redirected write; a forbidden block switch can also make the decoder loop and consume a CPU core.
• The article reports confirmed in-the-wild exploitation and cites Imperva's demonstration of code execution on the official Node.js 24.22.0 Linux ARM64 image after several attempts.

Defensive Notes

• Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1, or install the fixed package for the affected runtime or consumer. End-of-life Node.js release lines have no patch.
• Rebuild affected container images and compiled Bun executables, restart processes, and inventory other consumers of Brotli. Updating the operating system's libbrotli does not fix Java brotli4j because it bundles its own native Brotli build.
• If patching is delayed, set inflate: false on Express 5 and body-parser 2.x parsers or reject Content-Encoding: br at a reverse proxy. These are incomplete mitigations: they do not protect outbound decoding and can break legitimate compressed requests.
• Investigate decoder errors, worker exits with signal 139, sustained CPU use during decompression, and unexpected bytes in decompressed responses. Correlate by workload identity; no single signal is conclusive.
• Do not rely on payload signatures, WAF content matching, or body-size limits as complete detection or mitigation. The article says the attack is in the decoding process, the web server does not see decoded content, and tested middleware counted decompressed bytes.