A new vulnerability affecting the Brotli decoder used by Node.js was published on 21 October 2026. Referenced as CVE-2026-111497 and dubbed Node2Shell, this memory corruption flaw could allow an attacker to compromise applications that process malicious compressed data.
With a CVSS v4.0 score of 9.2/10, this vulnerability poses a significant risk to organisations using Node.js.
A vulnerability at the heart of the Brotli decompression mechanism
Brotli is a compression algorithm widely used on the web to reduce the size of data exchanged between servers and clients. It is integrated into Node.js to enable the compression and decompression of data streams.
CVE-2026-111497 exploits a memory management error in the Brotli decoder. When a specially crafted compressed stream is processed, the program may perform an out-of-bounds write to allocated memory.
This malfunction can cause memory corruption and lead to several consequences, ranging from an unexpected application crash (denial of service) to the disclosure of sensitive information held in memory, or even remote code execution.
The unique aspect of this vulnerability lies in its attack vector: a simple malicious compressed data stream can be enough to trigger the flaw, provided a vulnerable application agrees to decompress it.
How can CVE-2026-111497 be exploited?
Exploitation of this vulnerability relies on an attacker's ability to have a malicious Brotli stream processed by an application using a vulnerable version of the decoder.
In a Node.js environment, several features may be affected:
- The node:zlib module, which allows applications to compress and decompress data.
- The fetch() API, which can automatically decompress HTTP responses using Brotli encoding.
An attacker could exploit this vulnerability by transmitting malicious Brotli data via an HTTP request or response. However, the risk depends on the application's ability to decompress data controlled by the attacker.
Which versions are affected and how can you protect yourself?
The vulnerability affects several Node.js branches. Security updates were released on 21 October 2026 to fix the issue:
- Node.js 22.x: fixed in version 22.23.4 and later
- Node.js 24.x: fixed in version 24.22.1 and later
- Node.js 26.x: fixed in version 26.12.1 and later
Versions prior to the specified patches should be considered vulnerable when using the affected component.
Patches have also been released for Brotli in versions 1.0.10, 1.1.1, and 1.2.1. Other applications embedding vulnerable versions of this library may therefore be affected and require specific updates, even if they do not use Node.js.
To mitigate the risks, updating to a patched version is the primary protective measure.
Identify vulnerable systems with Cyberwatch
When dealing with this type of vulnerability, the speed at which you can identify the affected assets plays a decisive role in reducing your attack surface.
The Cyberwatch vulnerability management solution helps organisations inventory their IT infrastructure, identify vulnerable software, and prioritise remediation actions.
To find out more about vulnerability management and the features of Cyberwatch, contact our team.
