Node2Shell Detection Guide Maps Brotli Crashes and Follow-On Activity Across Three Hosts
Summary
A LogTotal review of 11 events examines Brotli decoder crashes and suspicious follow-on processes across Node.js, Python and Windows hosts in a Node2Shell (CVE-2026-111497) sample, with cross-runtime patching and triage guidance.
Key points
- CVE-2026-111497 is an out-of-bounds write in Google’s Brotli C decoder, affecting versions 1.0.3 to 1.2.0; the article says attacker-controlled Brotli data can crash decoders and code execution has been demonstrated against Node.js.
- Exposure can affect Node.js, Python packages, Bun, .NET, Envoy, Istio, curl and other Brotli consumers when attacker-controlled data reaches the decoder.
- The sample contains 11 events across three hosts. LogTotal reported one suspicious chain with medium confidence and filtered another chain during AI verification.
- On app-node-01, logs showed a Node.js Brotli decoder crash followed by child processes running curl, wget, ping and cat; the article treats this as exploitation-related activity.
- The sample also showed a Python Brotli crash on web-prod-01 and Node.js spawning download-and-execute commands and hidden PowerShell on win-dev-01.
- The article lists fixed versions for affected runtimes and packages, and says Node.js 20 and other end-of-life lines have no fix. It recommends patching all Brotli consumers and rebuilding or restarting affected deployments.
- Until updates are applied, the article recommends blocking Brotli request decompression where feasible, collecting kernel, coredump and EDR events, and investigating all hosts with suspicious runtime child processes.
Article Details
- Defense Focus
- Detect exploitation of CVE-2026-111497 across runtimes that decompress Brotli data, and investigate related post-exploitation activity across affected hosts.
- Detection Methods
- Alert on Node.js or Python Brotli decoder crashes, including a libbrotlidec.so crash with BrotliDecoderDecompressStream on the stack and crashes in _brotli.cpython-311.
- Hunt for node, node.exe, or python3 spawning shells, downloaders, or network utilities.
- Correlate process-creation events with kernel and systemd-coredump logs; review findings outside the reported detection chain.
- Check for cryptomining activity, including cron entries, systemd units, and a running xmrig process.
- Data Sources
- Linux kernel messages
- systemd-coredump messages and stack traces
- Microsoft Defender for Endpoint process-creation events
- Rule Types
- LogTotal detection and correlation rules for Brotli decoder crashes and suspicious Node.js child processes
- EDR process-creation detections for command shells, PowerShell, downloaders, and suspicious child processes
- Platforms
- LogTotal
- Microsoft Defender for Endpoint
- WAF or proxy
- Defensive Actions
- Patch every runtime, proxy, and distribution Brotli package that can decode attacker-controlled data; restart processes and rebuild affected images.
- Prioritize services that decompress request bodies, fetch user-supplied URLs, or pass untrusted data to Brotli functions.
- Until patched, reject Content-Encoding: br at the WAF or proxy, including case-insensitive values and encodings listed alongside other values.
- Disable automatic Brotli decompression where feasible and run Node.js unprivileged.
- Isolate affected hosts, collect process, system, and network data for the incident window, and remove unauthorized binaries.
- Expand triage beyond app-node-01 to web-prod-01 and win-dev-01; review accounts after the reported /etc/passwd read.
- Block egress to the reported payload host and investigate the reported DNS callback.
- Forward kernel, systemd-coredump, and EDR process events from all relevant Node.js and Python hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 5axzi7[.]dnslog[.]cn | Domain used for the reported out-of-band callback check via ping. |
| IPV4 | 198[.]51[.]100[.]23 | Listed in the sample as the payload host for a script download and a Windows download-and-execute command. |
| URL | hxxp[:]//198[.]51[.]100[.]23:3000/s.sh | Script URL fetched by wget on app-node-01 in the reported post-exploitation activity. |
| URL | hxxps[:]//198[.]51[.]100[.]23/api/w | Payload URL piped to cmd on win-dev-01 in the reported download-and-execute activity. |
MITRE ATT&CK
T1059.001 · PowerShellOn win-dev-01, node.exe spawned a hidden powershell.exe process that ran whoami.T1059.003 · Windows Command ShellOn win-dev-01, node.exe spawned cmd.exe to run curl and pipe the response to cmd.T1071.004 · DNSThe article identifies ping to 5axzi7.dnslog.cn as an out-of-band callback check.T1087.001 · Local AccountThe reported post-exploitation commands included reading /etc/passwd on app-node-01.T1105 · Ingress Tool Transfercurl and wget fetched scripts or payloads from the reported payload host on Linux and Windows.T1496 · Resource HijackingThe reported Linux activity included fetching a C3Pool XMRig miner setup script.T1499.004 · Application or System ExploitationThe article explicitly maps the Brotli decoder crash from the exploitation attempt to denial of service.
CVE
People
Vendors
Products
.NET25 October Microsoft released out-of-band .NET fixesBunSince the flaw sits in a shared compression library, it reaches Node.js, Python Brotli packages, Bun, curl, Envoy, and other software that decodes Brotli.EnvoySince the flaw sits in a shared compression library, it reaches Node.js, Python Brotli packages, Bun, curl, Envoy, and other software that decodes Brotli.IstioIstio 1.29.9, 1.30.6, 1.31.2LogTotalThis article covers Node2Shell/HTTP2Shell detection using a log sample analyzed in LogTotal, a log analysis tool that matches events to known threats.Microsoft Defender for EndpointSources 4 plain-text Linux kernel and systemd-coredump messages; 7 Microsoft Defender for Endpoint process-creation eventsNode.jsSince the flaw sits in a shared compression library, it reaches Node.js, Python Brotli packages, Bun, curl, Envoy, and other software that decodes Brotli.