Understanding the Brotli Vulnerability in Node.js and Python: Critical RCE Flaw CVE-2026-111497 (2026)

What is Node2Shell

Node2Shell is the name given to CVE-2026-111497, a vulnerability in the Brotli decoder bundled with Node.js and out-of-bounds memory write vulnerability in Google's Brotli compression decoder (versions 1.0.3 through 1.2.0).

This name was coined by Imperva’s Red Team. The issue has been fixed in Node.js versions 22.23.4, 24.22.1 and 26.12.1.

The vulnerability can cause the Node.js process to crash, lead to memory disclosure and allow an attacker to execute arbitrary code when it decompresses a malicious Brotli stream.

Why is that vulnerability called Node2Shell

Imperva’s Red Team named this vulnerability "Node2Shell" because the initial success achieved in exploiting remote code execution (RCE) during the demonstration occurred within unupdated Node.js runtime environments.

What is the HTTP2Shell Vulnerability

HTTP2Shell is nickname used for CVE-2026-111497. It began circulating on October 23, 2026, after researchers found that the vulnerability or flaw affects Node.js, Python and other software. As the name suggests, it impacts HTTP clients and servers and this flaw is not exclusive to HTTP/2.

Both are essentially the same thing, just with different names both refer to a vulnerability in the Brotli decoder.

What is CVE-2026-111497

CVE-2026-111497 a security vulnerability has been found in Google's Brotli decoder, which is used in Node.js to decompress data.

This is also called Node2Shell, which allows an attacker to crash the application, gain access to sensitive data or memory or execute malicious code specifically through the use of specially crafted compressed data.

This vulnerability has been fixed in these versions of Node.js: 22.23.4, 24.22.1, and 26.12.1.

Impact of CVE-2026-111497 on Node.js, Python, .NET, and Other Software

The impact of CVE-2026-111497 varies depending on the software or application and how it processes compressed data. If exploitation is successful, it could lead to an application crash, memory disclosure or the execution of arbitrary code. Below are some CVE-2026-111497 impacts.

CVE-2026-111497 affects software and languages such as 

• JavaScript: Node.js and Bun
• Python: Brotli and brotlicffi packages
• C# / .NET: Affected .NET runtimes and applications, but .NET Framework is not affected
• Java: Applications using affected Brotli libraries, such as Brotli4j
• C / C++: Applications using vulnerable versions of Google's Brotli library
• Other software: Envoy, Istio, PowerShell

This does not mean that all such applications are vulnerable - the risk only arises if they depend on a specific version of the Brotli decoder.

However, its greatest impact is specifically on Node.js and Python.
This vulnerability was first discovered in Node.js, but it also impacts other software that uses vulnerable Brotli decoder implementations.

Which Node.js versions are affected and Which are fixed

The Node.js versions that are affected by CVE-2026-111497 (Node2Shell) are 22.x, 24.x, and 26.x.

It is recommended that to use an updated patch version. Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, or a newer patched release in a supported release line.

 

Apart from Node.js CVE-2026-111497 affects other software as well; their patched versions are provided below.

• Python: Brotli 1.2.1 and brotlicffi 1.2.1.0
• .NET: 8.0.33, 9.0.22, and 10.0.14
• Java: Brotli4j 1.24.0
• Envoy: 1.40.0, 1.39.3, 1.38.6, and 1.37.8
• Istio: 1.31.2, 1.30.6, and 1.29.9
• Google Brotli library: 1.0.10, 1.1.1, and 1.2.1

Important: Some applications and operating systems include their own Brotli decoders or utilize modified versions of them.

Consequently, updating Python, Node.js, or any other package may not necessarily resolve the issue for every affected application. Please consult the security advisory provided by the relevant software vendor and install the appropriate security updates accordingly.

How to Detect CVE-2026-111497 (Node2Shell)

• Check Node.js Version - First, run the node -v command to identify which version is installed this will allow you to compare it against the affected version and proceed with applying the appropriate patched version.
• Audit Python Packages - Run the pip command to display `Brotli brotlicffi, which will allow you to see the version of the installed package.
• Scan Dependencies - Use tools such as npm audit, pip-audit, or software composition analysis to discover vulnerable dependencies.
• Review Security Logs - Always keep checking the logs; they will reveal issues such as unexpected application crashes or excessive memory usage, helping you identify what is going wrong.

How to Fix and Mitigate CVE-2026-111497 (Node2Shell)

To protect against CVE-2026-111497, update to the patched versions immediately; if an immediate update is not possible, temporarily disable the vulnerable Brotli decompression wherever feasible and avoid processing untrusted compressed data until the patch is applied.

Who Discovered CVE-2026-111497 (Node2Shell)

CVE-2026-111497 (known as Node2Shell or HTTP2Shell), security researchers Khai Tran and Sylvie Mayer, who are part of the Codex security team, discovered this issue. They were testing and analyzing security vulnerabilities in Node.js, specifically looking at how compressed data is processed. During this process, they discovered this CVE flaw in the Brotli decoder.

And the vulnerability was fixed by Matteo Collina and Antoine du Hamel as per Node.js team updates.

What are the real-world risks for Node.js and Python applications

If Node.js and Python applications use vulnerable Brotli decoders, they could face serious security risks when processing malicious compressed data. A successful exploit could lead to:

• Remote Code Execution (RCE) - An attacker can execute malicious code that could affect the server.
• Data Exposure - Sensitive information could be leaked, such as API keys, tokens, session data, etc.
• Denial of Service (DoS) - An attacker can provide malicious input that could crash or disrupt the application.
• Infrastructure Compromise - By gaining unauthorized access potentially to a server, the cloud or a database an attacker could cause damage to infra to the compromised application.