The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a serious vulnerability known as Node2Shell (CVE-2026-111497) to its Known Exploited Vulnerabilities catalog. Exploit code is already in circulation targeting Node.js servers, urging developers and system administrators to apply patches immediately. Federal agencies must address the issue by November 10, 2026. The flaw involves Google’s Brotli data compression library and allows remote attackers to potentially corrupt memory, leak data, crash applications, or run code—all without any login required.
How Node2Shell Works and Who’s Affected
The vulnerability arises from an unchecked return value in Brotli’s decoding process. When the decoder misinterprets certain “switch” commands—particularly when a block expects only one type—it returns a false signal. In one scenario where more data is needed, the decoder drains an internal buffer; in another, it doesn’t. That discrepancy allows the buffer to overflow, letting an attacker write outside its intended memory space. Because the write offset is signed 32-bit, it can target locations within ~2GB with 16 bytes of attacker-controlled data. A patch (upstream commit 0ed4268a) corrects the behavior by returning a proper error code (“BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH”) when faulty streams arise. This vulnerability has existed since Brotli version 1.0.3 (March 2018) and was only fixed in certain upstream branches in early 2026, though until recently those fixes had no release or advisory.
Node.js versions 22.x, 24.x, and 26.x are vulnerable, along with older, unsupported lines like 20.x, 23.x, and 25.x. Fixed Node.js versions include 22.23.4, 24.22.1, and 26.12.1. On the Brotli side, patched releases are 1.0.10, 1.1.1, and 1.2.1. The flaw also extends beyond Node.js: the affected ecosystem includes Bun (versions pre-1.4.4), Python’s Brotli and brotlicffi packages up to 1.2.1, Envoy, the Ruby brotli gem, and various Linux distributions using Brotli libraries between 1.0.3 and 1.2.0. A notable quirk: even patched Node.js builds may show the same bundled Brotli version string, so verification must be done by checking the Node.js release number, not the Brotli version string.
Real-World Exploitation and Defenses
Western red team researchers first demonstrated remote code execution using Node2Shell in a live Node.js 24.22.0 Linux arm64 image via fetch and Express 5 request bodies. Version 24.22.1 already rejects the malicious input. Labs later replicated successful exploits on x86-64 systems, with shells obtained on services running Express 5.3.0, Koa 3, and the vanilla node:http server. However, some attack attempts simply crashed the target process. In uncontrolled settings, crashes can lead to core dumps exposing sensitive data like session tokens, cookies, or keys.
Scanning activity targeting the flaw was seen as early as October 26, 2026. One exploit delivery used a 23 million byte Brotli payload originating from a known malicious IP address, probing hosts running Node.js 24.22.0 on x86-64. Exploit chains rely on return-oriented programming (ROP), constructing an environment where /bin/sh is spawned via execvp. Missed attempts suggest this is still a developing threat, but the pace is accelerating.
What You Need to Do Now
If you’re running Node.js, upgrade to 22.23.4, 24.22.1 or 26.12.1 immediately. Update Bun (post-1.4.4), the affected Python packages, Envoy, Ruby’s gem, and any OS Brotli library. For systems like Debian and Alpine, ensure you apply specific distro advisories or patches (e.g. brotli 1.2.1-r0 etc.). Be aware that older Node.js lines (20.x, 23.x, 25.x) will receive no fixes—migrate off them.
In the meantime, take protective steps: block inbound HTTP requests with Content-Encoding: br if possible, monitor for large Brotli-encoded POSTs, worker crashes, and scan logs for relevant exploit indicators (IP addresses, hash patterns). Restrict access to core dumps and enforce shorter retention. Treat the federal deadline of November 10 as a hard target for all sensitive and public-facing systems.
Why it matters:Node2Shell represents a potent supply-chain threat—one where a widely used compression library’s mishandled behavior allows remote access and lateral escalation. It underscores how third-party dependencies can harbor critical flaws for years. Watch for details of exploitation in the wild, disclosures from maintainers about any lingering affected paths, and real-world impact, especially in hosting, cloud, and API-driven infrastructure. Teams that ignore this risk do so at their peril.
