cyber.hendryadrian.com
Vulnerability & Exploit · aikido.dev

Node.js Patches Brotli Flaw That Can Enable Remote Code Execution

· Original article ↗

Summary

CVE-2026-111497 is an out-of-bounds write in Node.js’s Brotli decoder. Patched Node.js and Bun versions are available; researchers reported lab code execution, but no in-the-wild exploitation had been reported as of October 22, 2026.

Key points

  • Malformed Brotli input can trigger an out-of-bounds write, potentially causing crashes, memory disclosure or remote code execution.
  • Exposure can occur when apps decompress attacker-controlled Brotli request bodies, fetch Brotli responses from other servers, or pass untrusted input to node:zlib.
  • Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1, or newer patches in those release lines; Bun 1.4.4 or newer also includes a fix.
  • Node.js 25.x, 23.x, 20.x and earlier are end of life and will not receive this fix.
  • Researchers reported code execution against an unmodified Node.js 24.22.0 build in lab conditions, though the exploit did not work on every attempt. No in-the-wild exploitation had been reported as of October 22, 2026.
  • Rejecting Brotli-encoded inbound requests or applying available edge rules can reduce some exposure, but upgrading is the only fix described that also addresses vulnerable Brotli responses fetched from other servers.

Article Details

Vulnerability Types
  • Out-of-bounds write
Severity
High
Affected Versions
  • Node.js 22.x versions before 22.23.4
  • Node.js 24.x versions before 24.22.1
  • Node.js 26.x versions before 26.12.1
  • Node.js 25.x, 23.x, 20.x and earlier
  • Bun versions before 1.4.4
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Reject incoming Brotli-encoded requests (Content-Encoding: br) at the reverse proxy, load balancer, or application middleware.
  • Use available edge firewall rules to block the attack in inbound requests.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes crafted Brotli input triggering the flaw in services that accept compressed requests, potentially enabling remote code execution; it reports no exploitation in the wild as of October 22, 2026.

CVE

CVE-2026-111497for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your app, the flaw can crash the process,

Vendors

AikidoHow Aikido helps: Aikido detects the vulnerability and shows you which repositories and container images still run a vulnerable version.VercelUse edge rules where your platform offers them: Vercel added firewall rules on October 21 that block the attack in inbound requests.

Products

body-parserServers that accept requests: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, and any client can send one. A bare Node.js HTTP server does not decode incoming Brotli bodies on itsBrotliNode.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of yourBunWho is affected: anyone running Node.js or Bun whose app decompresses Brotli data that an attacker could control.ExpressServers that accept requests: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, and any client can send one. A bare Node.js HTTP server does not decode incoming Brotli bodies on itsNode.jsNode.js shipped a security update on Wednesday for a flaw in how it decompresses Brotli data, a bug people are already calling Node2Shell (CVE-2026-111497). If an attacker can get a malicious payload in front of your

Related Articles