Critical Vulnerability Discovered in Google Brotli Impacts Node.js Applications: Urgent Actions Required
The Cybersecurity and Infrastructure Security Agency (CISA) has recently cataloged CVE-2026-111497, a significant vulnerability in Google Brotli that poses risks to Node.js applications, indicating confirmed exploitation in the wild. This alarming development has triggered immediate concerns among cybersecurity professionals and software developers alike.
Overview of the Vulnerability
Added to the Known Exploited Vulnerabilities catalog on October 27, 2026, this critical flaw could enable unauthenticated attackers to manipulate memory, disrupt services, disclose sensitive data, and, in severe cases, execute arbitrary code by using specifically crafted compressed streams. CISA has mandated a remediation deadline for federal agencies, urging them to resolve the issue by November 10.
Referred to in various aliases such as Node2Shell, HTTP2Shell, and Broccoli2Shell, this vulnerability registers a CVSS score of 9.2, categorizing it as extremely severe. While it primarily connects to the Node.js environment, the crux of the vulnerability lies within Google’s Brotli decoder, therefore necessitating immediate attention from developers relying on these technologies.
Technical Insights
The exploitability of the CVE-2026-111497 flaw hinges on whether an application processes compressed data controlled by attackers through the Brotli decoder. It’s essential to note that merely operating a vulnerable version of Node.js does not automatically expose an application to exploitation; the conditions under which the compressed data is processed play a critical role.
The defect is rooted in malformed Brotli block switches. Specifically, when a stream declares a single block type, switching types becomes invalid. Yet, vulnerable decoder helpers inaccurately deliver the same boolean result for both an invalid switch and insufficient input. This oversight results in the decoder continuing to request bytes instead of rejecting the malformed stream, eventually leading to an overflow of an internal eight-byte buffer, thereby corrupting adjacent memory.
This vulnerability intricately combines elements of two common software weaknesses: CWE-252, which pertains to unchecked return values, and CWE-787, associated with out-of-bounds writes. Google has implemented a patch that introduces a new error type, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, enabling immediate termination of handling invalid streams. The affected Brotli release branches start from version 1.0.3, with updates available in versions 1.0.10, 1.1.1, and 1.2.1.
Potential Attack Vectors
The avenues for exploiting this vulnerability include requests that carry the header Content-Encoding: br, malicious responses processed through the built-in fetch(), and direct decompression with node:zlib. Particularly, Express body-parsing middleware and Koa integrations are vulnerable as they typically decompress request bodies prior to executing route handlers.
In comparison to previously reported vulnerabilities such as React2Shell, which was focused on React Server Components deserialization, the Node2Shell vulnerability is distinctly centered around processing compression.
Recent investigations by ELLIO revealed a technical replication of the vulnerability, successfully executing code against four unmodified x86-64 targets operating on Node.js version 24.22.0. This includes applications using Express and Koa, as well as a standard HTTP application that engages in decompressing incoming data. Critically, shells obtained in this exploit inherited the service account’s privileges, allowing an attacker to potentially gain a root shell if the container in question is running as root.
On October 26, ELLIO reported an exploitation request of over 23 million bytes originating from the IP address 94.154.43.7, which targeted the official Node.js x86-64 binary.
Security Recommendations
While researchers were able to identify multiple failed exploitation attempts—50 in a controlled laboratory setting—these failures can still disrupt service availability. Crashes may expose sensitive process memory or credentials if core dumps are enabled, presenting additional security risks.
To mitigate these risks, system administrators are encouraged to implement essential Node.js security updates such as versions 22.23.4, 24.22.1, or 26.12.1. For installations of versions 20.x, 23.x, and 25.x that are no longer supported, migration to a current version is imperative. Additionally, administrators should rebuild affected containers, restart services, and ensure that other bundled Brotli implementations are updated accordingly.
To reduce exposure paths, temporarily rejecting Brotli-encoded inbound bodies may be a beneficial interim measure, although this does not address risks associated with maliciously compressed responses. It is crucial to verify runtime release versions rather than depending on process.versions.brotli, as patched builds could still carry the outdated library version string.
Cybersecurity professionals must act swiftly to comprehend and address this vulnerability to avert potential breaches and ensure the integrity and availability of their systems. Awareness and proactive management remain key strategies in defending against these threats, highlighting the importance of continual vigilance in an ever-evolving cybersecurity landscape.