Node2Shell: Critical Brotli RCE Affects Node.js and Bun
Summary
Node2Shell (CVE-2026-111497) is a critical out-of-bounds write in Brotli decoding that can enable remote code execution. The article reports in-the-wild exploitation and lists fixes for Node.js and Bun.
Key points
- The flaw occurs when the Brotli decoder mishandles an invalid block-type switch, continues from a corrupted state, and writes beyond its buffer.
- The article reports CVSS v4.0 9.2 and says in-the-wild exploitation was confirmed on October 26, 2026.
- A crafted Brotli stream sent to a vulnerable service, or fetched by it, can cause a crash, expose process memory, or enable remote code execution.
- Fixed Node.js versions are 22.23.4, 24.22.1, and 26.12.1; end-of-life 20.x and 25.x lines have no listed fix.
- Bun versions through 1.4.3 are affected; version 1.4.4 includes the fix.
- Some Linux distribution builds use the system Brotli package, so the Node.js version alone may not show whether the issue is fixed.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Unchecked return value
- Severity
- CVSS v4.0 9.2 (Critical)
- Affected Versions
- Node.js 26.x before 26.12.1
- Node.js 24.x before 24.22.1
- Node.js 22.x before 22.23.4
- Node.js 25.x
- Node.js 20.x and older
- Bun up to 1.4.3
- Google Brotli 1.0.3 through 1.2.0
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationAttackers can send a crafted Brotli stream to a vulnerable Node.js service to exploit Node2Shell and execute code remotely.T1499 · Endpoint Denial of ServiceA malformed Brotli stream can terminate the vulnerable Node.js process; repeated requests can keep the service down.
CVE
Vendors
Products
BrotliNode2Shell, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js, rated CVSS 9.2.BunBun up to 1.4.3 is affected, and distribution Node.js builds may need a patched system Brotli package.Node.jsNode2Shell, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js, rated CVSS 9.2.