CVE-2026-111497: Brotli decoder out-of-bounds write in Node.js enables RCE (Node2Shell)

Exploited in the wild Critical 9.2 EPSS 82.6% Brotli

An unchecked return value in the Google Brotli decoder (versions 1.0.3 to 1.2.0) turns a malformed block switch into an out-of-bounds write, so attacker-supplied Brotli data reaching Node.js through request bodies with Content-Encoding: br (Express 5 / body-parser 2), Brotli responses decoded by fetch(), or node:zlib Brotli calls can crash the process, leak memory or run code. Public exploits give a shell on official Node.js 24.22.0 builds and CISA added it to the KEV catalog on 2026-10-27 (due 2026-11-10). Fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in Brotli 1.0.10/1.1.1/1.2.1; distro Node.js builds that link the system libbrotli are fixed by the brotli package update.

Also known as “Node2Shell”.

• CVE-2026-111497CVE identifier
• 9.2CVSS 4.0 base score (critical)
• 2026-10-27added to CISA's exploited list (US federal deadline 2026-11-10)
• 82.6%EPSS: chance of exploitation in the next 30 days (higher than 100% of CVEs)
• 2026-10-22published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Node.js 22.x up to 22.23.3
• Node.js 24.x up to 24.22.0
• Node.js 26.x up to 26.12.0
• End-of-life Node.js 20.x, 23.x, 25.x and older (bundled Brotli, no fix)
• Google Brotli 1.0.3 to 1.0.9, 1.1.0 and 1.2.0 (system library used by Debian, Ubuntu, Alpine, FreeBSD and some RHEL Node.js builds)

Fixed in:

• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
• Brotli 1.0.10
• Brotli 1.1.1
• Brotli 1.2.1

Node.js lines affected: 22.x || 24.x || 26.x; fixed in ^22.23.4 || ^24.22.1 || ^26.12.1.

Am I affected?

node -v   # official/NodeSource/nvm/Docker builds bundle Brotli: need 22.23.4, 24.22.1, 26.12.1 or later
ldd "$(command -v node)" | grep -i brotli   # output = node uses the system libbrotli, so the brotli package must be updated
# process.versions.brotli is not a reliable indicator: it still reports 1.2.0 on patched Node.js builds
dpkg -l libbrotli1 | grep ^ii                  # Debian/Ubuntu
rpm -q brotli libbrotli; dnf module list --enabled nodejs   # RHEL
apk info -v brotli-libs nodejs nodejs-current   # Alpine
pkg audit -F                                    # FreeBSD
sudo lsof -n 2>/dev/null | grep -E 'libbrotli.*\(deleted\)'   # processes still using the old library after an update

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt install --only-upgrade libbrotli1 nodejs
# Debian's nodejs links the system libbrotli; NodeSource builds bundle their own and need nodejs >= 22.23.4 / 24.22.1 / 26.12.1
node -v

sudo apt update
sudo apt install --only-upgrade libbrotli1 nodejs
# Ubuntu nodejs on 22.04+ uses the system brotli (USN-8956-1); 20.04 nodejs uses a vendored copy and is still marked 'needed'
node -v

# System brotli (used by nodejs:22 on RHEL 8/9 and nodejs22/nodejs24 on RHEL 10)
sudo dnf upgrade --refresh brotli      # RHEL 8
sudo dnf upgrade --refresh libbrotli   # RHEL 9 / 10 (and brotli if installed)
# nodejs:24 module streams bundle brotli (RHEL 8/9)
sudo dnf upgrade --refresh 'nodejs*'
node -v

sudo dnf upgrade --refresh libbrotli brotli

sudo zypper refresh
sudo zypper update libbrotlicommon1 libbrotlidec1 brotli

sudo dnf upgrade --releasever=latest libbrotli brotli

sudo pacman -Syu

apk update
apk upgrade brotli-libs          # main-repo nodejs uses the system library
apk upgrade nodejs-current       # 3.24 community, if installed (26.12.1-r0)
node -v

pkg update
pkg upgrade brotli node24   # node ports link the system brotli; or node22 / node26 / node
pkg audit -F

# Official node images ship the upstream binary with bundled Brotli: rebuild on a fixed tag
#   FROM node:24.22.2-trixie-slim   (also: node:22.23.4-alpine, node:26.13.0-slim)
docker pull node:24.22.2-trixie-slim
docker build --pull -t myapp:patched .
docker run --rm myapp:patched node -v   # must be 22.23.4 / 24.22.1 / 26.12.1 or later
docker compose up -d --force-recreate

# nvm: install the newest patch release of your line and make it the default
nvm install 24 --reinstall-packages-from=current   # or 22 / 26
nvm alias default 24
node -v   # must be at least 22.23.4 / 24.22.1 / 26.12.1
# Official binaries (Linux x64); verify the checksum before installing
VER=v24.22.2   # current fixed releases: v22.23.4, v24.22.2, v26.13.0
curl -fsSLO https://nodejs.org/dist/$VER/node-$VER-linux-x64.tar.xz
curl -fsSLO https://nodejs.org/dist/$VER/SHASUMS256.txt
grep " node-$VER-linux-x64.tar.xz\$" SHASUMS256.txt | sha256sum -c -
sudo tar -xJf node-$VER-linux-x64.tar.xz -C /usr/local --strip-components=1
/usr/local/bin/node -v

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Until patched, reject inbound requests with Content-Encoding: br at the reverse proxy, load balancer or app middleware (Aikido, ELLIO). nginx example inside server {}: if ($http_content_encoding ~* br) { return 415; }
• That does not cover Brotli responses your app fetches (fetch()/undici, axios, got, webhooks, link previews, URL-fetching tools); only the update removes that path.
• Failed exploit attempts crash the worker; where core dumps are enabled the cores can contain other users' sessions and keys, so restrict access to /var/lib/systemd/coredump and keep cores short-lived (ELLIO).
• Node.js 20.x, 23.x and 25.x are end-of-life and get no fix: move to 22.x, 24.x or 26.x.

Look for signs of exploitation

• ELLIO saw a scanner with User-Agent 'Mozilla/5.0 (compatible; node2shell-check/1.0)' sending POST bodies with Content-Encoding: br in bursts before exploitation.
• In-the-wild exploit (26 Oct 2026, from 94.154.43.7) was a single Brotli-coded request body of about 23 MB targeting Node.js v24.22.0 x86-64 (ELLIO).
• Repeated Node.js worker crashes (segfaults) followed by supervisor restarts while receiving Brotli-encoded requests; patched builds reject the trigger with ERR__ERROR_FORMAT_BLOCK_SWITCH.

Related vulnerabilities

• CVE-2026-105482
• CVE-2026-105483
• CVE-2026-106069

Sources

• Node.js security releases, October 21, 2026
• CVE record CVE-2026-111497
• NVD: CVE-2026-111497
• CISA KEV: CVE-2026-111497 (added 2026-10-27)
• Google Brotli 1.2.1 release
• GitHub advisory GHSA-9v8h-qqgm-4m35 (CVE-2026-111497)
• Debian security tracker: CVE-2026-111497
• Ubuntu CVE tracker: CVE-2026-111497
• USN-8956-1 Brotli vulnerability
• Red Hat CVE page: CVE-2026-111497
• Alpine secdb (v3.22/v3.23/v3.24 main + community)
• FreeBSD VuXML: brotli
• FreeBSD VuXML 33a752ba-4cbe-46d8-abda-587011d90575 (Node.js, October 2026)
• Docker official image: node (tags)
• ELLIO: Node2Shell, remote code execution on stock Node.js builds
• Aikido: Node2Shell (CVE-2026-111497)
• oss-security: Brotli CVE-2026-111497 thread
• Node.js release status (previous releases)
• https://github.com/andybalholm/brotli/releases/tag/v1.2.7
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 17:06 UTC and reviewed by an editor. Always confirm with your vendor's advisory.