Node2Shell flaw in bundled Brotli parser allows remote code execution on official Node.js builds

Out-of-bounds write inside bundled Brotli yields native shell on stock Node containers

Across three active release trains spanning Node.js 22.x, 24.x, and 26.x, the default decompression engine bundled into the official Node.js runtime contained a critical out-of-bounds write vulnerability that yields remote code execution. Designated CVE-2026-111497 and assigned a CVSSv4.0 score of 9.2 Critical, the defect resides within the native Google Brotli decoder in c/dec/decode.c, which Node.js compiles directly into its runtime binary. On 21 October 2026, the Node.js project published emergency security updates across all supported branches (Node.js 24.22.1, 22.20.1, and 26.0.1) to resolve the memory corruption primitive.

Technical research disclosed under the name Node2Shell established that the defect is not merely a theoretical crash condition. Researchers demonstrated practical remote code execution against standard, unmodified Docker container images distributed by the Node.js project (node:24.22.0-linux-arm64). Working against stock binaries with Linux kernel Address Space Layout Randomisation (ASLR) and compiler stack canaries fully operational, the exploit achieved a native container shell without requiring attached debuggers, unusual compile-time flags, or relaxed operating system memory protections.

What the vulnerability record establishes and what it leaves unstated

To separate verified exploitation mechanics from speculative threat narratives, security teams must evaluate the formal disclosure record against production operational realities.

Audit of verified technical disclosures for CVE-2026-111497 versus operational assumptions

Technical Dimension	Explicitly Established in Disclosure	Not Stated or Dependent on Environment
Vulnerable Code	Out-of-bounds write inside c/dec/decode.c affecting bundled Google Brotli 1.0.3 through 1.2.0.	Whether custom Node.js binaries linked dynamically against patched system Brotli packages require runtime updates.
Architecture Target	Demonstrated on official node:24.22.0-linux-arm64 container images under standard ASLR.	Specific heap groom timing and offset adjustments required for x86_64 production server deployments.
Inbound Attack Surface	Express 5.0.0 through 5.3.0 and body-parser 2.0.0 through 2.3.0 decompressing Content-Encoding: br.	The proportion of public Node.js web applications running legacy body-parser configurations that reject Brotli payloads.
Outbound Attack Surface	Node.js global fetch() client automatically requests and decodes Brotli responses.	Telemetry on whether upstream corporate microservices or partner APIs have been actively weaponised.
Legacy Release Support	End-of-life release lines 18.x and 20.x receive zero upstream security patches from the Node.js project.	Estimated enterprise footprint of legacy unmaintained Node.js containers deployed in private cloud clusters.

The friendly-name fallacy: why out-of-bounds write became a full remote shell

The architectural impact of CVE-2026-111497 illustrates a classic friendly-name fallacy in modern runtime security. Many vulnerability management dashboards classify CWE-787 (Out-of-bounds Write) as a denial-of-service hazard, presuming that modern memory mitigations such as ASLR and non-executable stack protections prevent arbitrary execution in managed runtime environments. In Node.js, developers frequently assume that because application code is written in high-level JavaScript or TypeScript, low-level memory corruption bugs cannot compromise the host.

In reality, Node.js delegates performance-critical compression tasks to native C libraries compiled into the runtime binary. When a crafted Brotli payload forces an illegal block-type transition during stream parsing, the decoder in c/dec/decode.c fails to halt execution immediately with a format error. Instead, the loop misinterprets the corrupt state as a request for additional input data, advancing internal pointers beyond the allocated destination buffer and writing controlled attacker bytes directly across adjacent heap structures.

Zoom

As detailed in the technical diagram, the attack vector exhibits dangerous asymmetry. In inbound request pipelines, popular application frameworks like Express 5 and modern body-parser middleware automatically decompress request bodies carrying a Content-Encoding: br header before application logic executes. While cloud perimeter Web Application Firewalls (such as those deployed by Vercel and Imperva) can inspect incoming POST bodies and filter malformed Brotli headers at the edge, they provide zero protection for outbound operations. When a Node.js microservice invokes fetch(), the runtime includes Accept-Encoding: br, gzip, deflate by default. If a compromised upstream API or partner endpoint returns a malicious compressed payload, the response bypasses edge firewalls entirely, executing directly inside the internal application runtime.

Upstream Brotli boundary enforcement and patch validation

The root-cause remediation imported from the Google Brotli 1.2.1 codebase hardens block-type transition checks inside c/dec/decode.c. Rather than allowing the parsing engine to remain in an ambiguous state upon encountering unexpected stream markers, the updated decoder enforces immediate termination:

/* Google Brotli upstream state validation in c/dec/decode.c */
if (s->substate_read_block_length == BROTLI_STATE_READ_BLOCK_LENGTH_SUFFIX) {
    /* Enforce strict stream boundary verification */
    if (BrotliCheckBlockTypeTransition(s, block_type) != BROTLI_DECODER_SUCCESS) {
        s->state = BROTLI_STATE_ERROR;
        return BROTLI_DECODER_RESULT_ERROR;
    }
}

By immediately transitioning to BROTLI_STATE_ERROR upon detecting an inconsistent block state, the patched engine prevents the decoding loop from executing further memory write operations. The update has been integrated into Node.js 24.22.1, 22.20.1, and 26.0.1. However, organizations operating legacy Node.js 18.x and 20.x containers receive no official fixes, leaving workloads exposed unless teams migrate to actively supported release trains.

UK regulatory governance and runtime supply chain assurance

For UK organizations operating Node.js microservices and digital portals, Node2Shell touches core regulatory and operational obligations. Under the UK National Cyber Security Centre (NCSC) Guidance on Memory Safety, public sector bodies and critical national infrastructure operators are strongly urged to eliminate vulnerable native memory management primitives from critical application paths and ensure rapid patching cycles for native dependencies embedded in managed runtimes.

Furthermore, Cyber Essentials Requirements for Infrastructure v3.3 mandate that all operating systems and software applications handling organizational data must be under active vendor support and updated within 14 days of a critical vulnerability disclosure. Organizations running containerised Node.js 18.x or 20.x workloads in production fail Cyber Essentials compliance immediately, as those release trains have passed their end-of-life dates and will never receive official security remediations.

Under the UK Data Protection Act 2018 and UK GDPR Article 32, organizations processing personal data must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Because Node2Shell allows container compromise and native shell execution, an unpatched Node.js service processing customer records represents a severe compliance failure if exploited by threat actors to access internal databases or cloud secrets.

Defender checklist: securing Node.js runtime decompression

The exposing question

When your security architecture relies on perimeter Web Application Firewalls to inspect inbound client traffic, how many internal Node.js services automatically decompress compressed payloads received from third-party APIs beyond the perimeter?

Key facts