Node2Shell (CVE-2026-111497): Exploit Scope, Detection and Mitigation
Summary
Node2Shell is an out-of-bounds write in Brotli that affects Node.js services decoding attacker-controlled data. Code execution was demonstrated in a limited setup; patching, reducing exposure and monitoring post-exploitation behavior are advised.
Key points
- The flaw occurs when Brotli’s decoder ignores an error after a malformed stream requests a block-type switch, allowing a write past the buffer.
- Fixed Node.js releases are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older have no fix; distributions using system Brotli need separate package checks.
- Exposure depends on whether an application or library decompresses attacker-controlled Brotli data. Examples include Express 5’s default JSON parsing, server-side fetch responses and direct zlib use.
- As of October 23, no confirmed in-the-wild exploitation was reported. Public proof-of-concept code appeared quickly after the fixes.
- Researchers readily reproduced crashes; reliable remote code execution had been reproduced in one setup. Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, requiring several attempts.
- The article recommends patching, auditing Brotli decoding paths, limiting untrusted compressed input, running services with least privilege and monitoring for suspicious process activity.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Unchecked return value
- Buffer overflow
- Severity
- Critical (CVSS v4.0 9.2); the Node.js advisory rates it high
- Affected Versions
- Node.js 22.x versions before 22.23.4
- Node.js 24.x versions before 24.22.1
- Node.js 26.x versions before 26.12.1
- Node.js 25.x (no fix)
- Node.js 20.x and older (no fix)
- Brotli 1.0.3 through 1.2.0
- Bun 1.4.3 and earlier
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disable request decompression where possible; in body-parser, set express.json({ inflate: false }).
- Reject Content-Encoding: br on request bodies at the proxy or load balancer where clients do not send it.
- Use WAF rules to limit untrusted Brotli traffic on affected paths; this is a mitigation layer, not a fix.
MITRE ATT&CK
T1059.004 · Unix ShellThe article says successful code execution can let an attacker run commands as the Node.js service user and lists an interactive shell as a common follow-up.T1105 · Ingress Tool TransferMalware download is listed as a possible follow-up after successful exploitation.T1190 · Exploit Public-Facing ApplicationThe vulnerability can be triggered when a publicly reachable Node.js service decodes attacker-controlled Brotli data.T1496 · Resource HijackingCryptomining is listed as a possible follow-up after successful exploitation.T1499 · Endpoint Denial of ServicePublic PoC authors reported crashes on unpatched Node.js versions, causing denial of service to services that decode attacker-controlled Brotli.
CVE
Vendors
DebianDistribution packages need their own check. Debian’s tracker, read on October 23, lists nodejs 18.20.4 in bookworm, 20.19.2 in trixie, 24.21.0 in forky, and 24.22.0 in sid as vulnerable, and notes that Debian’s nodejsImpervain the Brotli decoder it bundles, versions 22.23.4, 24.22.1, and 26.12.1. One day later, on October 22, Imperva reported running code on the official Node.js 24.22.0 Docker image for Linux arm64. The vulnerability,Sysdigfalco feeds by sysdig
Products
body-parserExpress 5.3.0 depends on body-parser ^2.3.0.Brotlipast the end of a buffer. On October 21, 2026, Node.js shipped fixes for an out-of-bounds write in the Brotli decoder it bundles, versions 22.23.4, 24.22.1, and 26.12.1. One day later, on October 22, ImpervaBunAccording to Aikido, Bun is also affected. All versions 1.4.3 and earlier are vulnerable, and Bun 1.4.4 includes the fix. ExpressExpress 5 with express.json()Node.jscompressed stream, an ignored error, and a write past the end of a buffer. On October 21, 2026, Node.js shipped fixes for an out-of-bounds write in the Brotli decoder it bundles, versions 22.23.4, 24.22.1, andSysdig SecureSysdig Secure customers who use managed policies now have detections to identify and respond to Node2Shell. A Threat Intelligence entry shows where the exposure is, and runtime rules catch exploitation and the attacker