Threat reportVulnerabilityTL-2026-4277
Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE Exploit (CVE-2026-111497)
Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE (TL-2026-4277), also tracked as Node2Shell, is a high-severity software vulnerability, first published 2026-10-23. It has no confirmed attribution, affects OpenJS Foundation Node.js, references 1 CVE (CVE-2026-111497), maps to 6 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4277
- Threat ID
- TL-2026-4277
- Also known as
- Node2Shell
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, web-services, cloud
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
- Updates
- 2026-10-23 · revalidated 1× · latest source
Malware and tooling in Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
Malware and tooling: Node2Shell, ZLib - S0086
How Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE works
Node2Shell is a working remote code execution exploit, demonstrated by Imperva, against the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x (CVE-2026-111497). A crafted Brotli stream triggers an out-of-bounds write when Node.js decompresses attacker-controlled data, such as request bodies handled by body-parser or compressed responses consumed by fetch().
CVE-2026-111497 is a high-severity memory-safety flaw in the Brotli decoder bundled with Node.js (the bug is in the bundled Google Brotli library, not Node.js's own code). Per the Node.js advisory of 2026-10-21, a crafted compressed stream that declares a single block type and then switches blocks was not rejected. Imperva describes the trigger as an invalid transition between block types that the stream structure should make impossible: instead of treating it as a format error, the vulnerable decoder treats it as a need for more input and keeps processing with a corrupted internal state, which allows out-of-bounds writes beyond buffer boundaries. Node.js applied the upstream fix (google/brotli commit 0ed4268a4401abcb4472096340477cf4af7d1a2b), which makes the decoder return a format error for the invalid transition and pass it to the caller.
Exposure: any application that decompresses Brotli data it does not control. The affected Node.js APIs are zlib.brotliDecompress(), its synchronous form, and zlib.createBrotliDecompress(). Node.js's built-in fetch() requests Brotli encoding from HTTPS servers by default and decodes responses through the same code path, so a malicious or compromised server can target Node.js clients. On the server side, middleware that decompresses incoming request bodies (Express and body-parser, via the raw() and json() parsers) is an exposed path.
Imperva's Red Team validated the issue and published a working RCE proof of concept (Node2Shell) on 2026-10-22. Code carried inside the Brotli data executed inside the target process in official Node.js 24.22.0 Linux arm64 containers without debugger instrumentation; the test application contained no code to create the marker file, yet the file appeared after it received the Brotli data. Tested targets were Express 5.0.0 with body-parser 2.0.1, Express 5.3.0 with body-parser 2.3.0, standalone body-parser 2.0.0, and the built-in fetch() with compressed HTTP responses. The proof did not succeed on every attempt, and Imperva's results establish code execution only for the tested Linux arm64 build and application setups. Node.js 24.22.1 rejected the identical inputs. Imperva notes the research follows its earlier PHP2Shell work on untrusted compressed data leading to code execution.
The flaw was fixed in the 2026-10-21 Node.js security release (22.23.4, 24.22.1, 26.12.1), which patched 10 vulnerabilities, 4 of them high severity. Docker images and AWS Lambda base images for the fixed versions were published on 2026-10-21 to 2026-10-22. Imperva has added dedicated WAF rules validated against the exploitation attempts it reproduced, and lists unexpected process exits during decompression and decoder errors as signals that may help prioritize investigation, while stating neither is a reliable stand-alone sign of exploitation.
No in-the-wild exploitation, named threat actor, or network infrastructure has been reported in the reviewed sources; a third-party aggregator states no public exploitation or PoC existed at the time of the release, which was before Imperva's 2026-10-22 publication. Status is ACTIVE because a public working PoC now exists. Sources disagree on the CVSS score (9.2 and 8.1 appear in third-party aggregators, while the Node.js advisory had published only a title and High rating, with no CVSS or CWE, at release), so the score is left unset. Out-of-bounds write corresponds to CWE-787. Third-party aggregators state that end-of-life lines (Node.js 20 reached end of life on 2026-04-30; 18.x, 23.x and 25.x are also reported EOL) will not receive patches, that systems linking an older system Brotli predating the upstream fix are also affected, and one aggregator describes the affected library range as Google Brotli 1.0.3 through 1.2.0 (not confirmed by the Node.js advisory).
MITRE ATT&CK techniques used in TL-2026-4277
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1499 Endpoint Denial of Service
Resource Development
Affected products and versions in Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
- OpenJS Foundation — Node.js
Vulnerable versions: 22.x <= 22.23.3; 24.x <= 24.22.0; 26.x <= 26.12.0
Fixed in: 22.23.4; 24.22.1; 26.12.1 - Google — Brotli (bundled decoder)
Vulnerable versions: builds predating upstream commit 0ed4268a4401abcb4472096340477cf4af7d1a2b
Fixed in: builds including upstream commit 0ed4268a4401abcb4472096340477cf4af7d1a2b - Express / body-parser — Express 5.0.0-5.3.0 with body-parser 2.0.0-2.3.0 (exploitable request-body path when running on vulnerable Node.js)
Vulnerable versions: express 5.0.0-5.3.0 on vulnerable Node.js; body-parser 2.0.0-2.3.0 on vulnerable Node.js
Fixed in: any version running on patched Node.js 22.23.4, 24.22.1 or 26.12.1
Remediation for Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
Patches
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
- Builds of system-linked Brotli that include the upstream google/brotli fix (commit 0ed4268a4401abcb4472096340477cf4af7d1a2b)
Immediate actions
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 (or newer)
- Rebuild container images with the updated Node.js runtime (patched Docker and AWS Lambda base images were published 2026-10-21 to 2026-10-22)
- Temporarily restrict untrusted Brotli traffic (Content-Encoding: br) where feasible
- Deploy WAF rules that detect and block malformed Brotli payloads (Imperva has released dedicated rules)
Workarounds
- Disable or reject Content-Encoding: br on untrusted inbound request bodies
- Avoid Brotli decoding of responses from untrusted servers in fetch() until patched
Longer-term hardening
- Audit all code paths that decompress untrusted data: zlib.brotliDecompress, brotliDecompressSync, createBrotliDecompress, fetch() responses, Express/body-parser request decompression
- Monitor for unexpected process exits or decoder errors during decompression, correlated with runtime version
- Migrate off end-of-life Node.js lines (20.x and older, 23.x, 25.x) which will not receive a patch
CVEs associated with Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
Weaknesses (CWE) in Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
Timeline of Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
- Node.js 20 reaches end of life, so it receives no fix for CVE-2026-111497 (per the Konfirmity advisory summary).
- At release, an aggregator (SecurityOnline) reports no known public exploitation or proof of concept for CVE-2026-111497 and gives CVSS 9.2; the Node.js advisory itself published only a title and High rating.
- Node.js ships fixed versions 22.23.4, 24.22.1 and 26.12.1, applying the upstream google/brotli fix (commit 0ed4268) that makes the decoder return a format error on the crafted stream.
- Node.js project discloses CVE-2026-111497 (Brotli decoder out-of-bounds write permitting RCE) as part of a 10-vulnerability security release (4 high severity), alongside TLS hostname validation (CVE-2026-105483, CVE-2026-106069) and dns.resolve (CVE-2026-105482) fixes.
- SOC Prime reports a public PoC reached code execution only on a deliberately weakened test build, while standard builds yielded a crash and limited process-memory disclosure; this contrasts with Imperva's Node2Shell results on official 24.22.0 arm64 containers. No in-the-wild exploitation documented.
- Imperva reports adding dedicated WAF rules for CVE-2026-111497, validated against the exploitation attempts it reproduced (date aligned with Imperva's analysis publication).
- Imperva publishes the Node2Shell analysis demonstrating RCE on official Node.js 24.22.0 Linux arm64 containers via Express/body-parser (raw() and json()) and fetch() paths; patched 24.22.1 rejects the same inputs.
- Docker images and AWS Lambda base images for the fixed Node.js releases are published (2026-10-21 to 2026-10-22, per Konfirmity).
- Cyber Security News reports the Node2Shell exploit and urges immediate patching, container image rebuilds and WAF deployment.
Update history for TL-2026-4277
- 2026-10-23 — CVE-2026-111497: Node.js Brotli Decoder Out-of-Bounds Write Enables Remote Code Execution: What changed No field changes. Severity HIGH, exploitability POC_PUBLIC and status ACTIVE are unchanged; the newer report does not demonstrate any escalation. New indicators (1) 1 new entity indicator: OpenAI Codex Security (vulnerability r
Sources cited for Node2Shell: Node.js Brotli Decoder Out-of-Bounds Write RCE
- New Node2Shell Node.js RCE Exploit Let Attackers Execute Malicious Code Through Brotli-Compressed Data
- Imperva: Node2Shell - From Brotli Data to Remote Code Execution
- Node.js Security Release October 2026 (SecurityOnline)
- Patchstack: Out-of-bounds write in the bundled Brotli decoder leading to RCE (Node.js < 22.23.4)
- Konfirmity: Node.js October 2026 Security Releases
- FourWeekMBA: Node.js Fixes 10 Flaws, 4 High, on the Same Day as PHP
- google/brotli upstream fix commit 0ed4268
Detection coverage for TL-2026-4277
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4277 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.