On 21 October 2026, the Node.js project fixed CVE-2026-111497, since nicknamed Node2Shell, in its October 2026 security release. It is an out-of-bounds write in the Brotli decoder compiled into the Node.js binary, and the Node.js project rates its impact on the runtime as High, while Google, as the CVE Numbering Authority, scores it 9.2 on CVSS 4.0. Fixed versions are 26.12.1, 24.22.1 and 22.23.4.

Why the attack surface is broad

Node.js vendors its own copy of the Brotli library, so the flaw is a property of the runtime binary, not of any npm package. Node.js runs the bundled decoder any time it decompresses Brotli data: explicitly through node:zlib Brotli APIs, and implicitly in two places most teams do not think of as decompression code, the built-in fetch(), which transparently decodes responses sent with Content-Encoding: br, and body-parsing middleware that inflates compressed request bodies. Those two implicit paths turn a library bug into a broad attack surface, because most teams do not think of them as decompression code at all.

What else is affected

The same flaw also impacts Bun, the Python Brotli and brotlicffi packages, and Envoy and Istio deployments configured for Brotli decompression. GitHub's advisory lists the PyPI packages brotli, fixed in 1.2.1, and brotlicffi, fixed in 1.2.1.0. Bun 1.4.3 and earlier bundle an affected Brotli, and Bun 1.4.4 fixes it. Envoy published a critical advisory for deployments with a Brotli decompressor configured, fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8.

Every end-of-life line checked, from 20.x back to 12.x, bundles the vulnerable decoder and has no upstream fix available, so those lines must be migrated, not patched. Public analysis and proof-of-concept work appeared quickly after disclosure, and one report notes that on stock builds the public proof caused a crash and limited memory read rather than full code execution, which does not remove the need to patch. Verify the running binary version, not just the package declared in a lockfile, and where immediate patching is impossible, disable Brotli decompression of untrusted data.