Threat reportVulnerabilityTL-2026-4481
Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE (CVE-2026-111497) - Cloudflare Emergency WAF Rules
Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE (TL-2026-4481), also tracked as Node2Shell, is a high-severity software vulnerability, first published 2026-10-26. It has no confirmed attribution, affects OpenJS Foundation Node.js, references 1 CVE (CVE-2026-111497), maps to 3 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4481
- Threat ID
- TL-2026-4481
- Also known as
- Node2Shell
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, web-services, ecommerce, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
Malware and tooling: ZLib - S0086, Node2Shell
How Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE works
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder bundled with Node.js 22.x, 24.x and 26.x that can lead to remote code execution when untrusted Brotli data is decompressed. Node.js fixed it on 2026-10-21 (22.23.4, 24.22.1, 26.12.1) and Cloudflare shipped two Log-mode WAF rules on 2026-10-25.
CVE-2026-111497 is a memory-corruption flaw (out-of-bounds write) in the Brotli decompression library bundled with Node.js. Per secondary analysis of the fix, a crafted compressed stream that declares a single block type and then performs a block switch was not rejected by the decoder, producing an out-of-bounds write. Node.js rated the issue High in its 2026-10-21 security release, which fixed 10 CVEs (four High) in versions 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end-of-life (Node.js 20 EOL 2026-04-30) and will not be patched. Builds that link a system Brotli older than upstream google/brotli commit 0ed4268 are also reported to be vulnerable.
Exposure is any code path that decompresses Brotli data from an untrusted party: zlib.brotliDecompress()/brotliDecompressSync() directly; server-side handling of requests carrying Content-Encoding: br (for example Express with body-parser); and fetch(), which negotiates Brotli by default - sending Accept-Encoding: identity does not help because a malicious server can still reply with Content-Encoding: br. Proxies that decompress Brotli responses are also in scope. No authentication is required for the server-side vector.
Exploitation status: one secondary source (Konfirmity) reports Imperva achieved code execution on 2026-10-22 through both a Brotli response fetched via fetch() and a Brotli request body processed by Express/body-parser, and that Node.js 24.22.1 rejects the same input; the same source reports no in-the-wild attacks as of 2026-10-25. SecurityOnline states Node.js does not report exploitation and that no public PoC is confirmed. The originating article references 'Node2Shell' exploit coverage showing code execution via crafted Brotli data; this could not be independently confirmed. Credit for the finding is attributed to Matteo Collina (Patchstack). Severity data conflicts across sources: Node.js rates it High; Patchstack lists CVSS 8.1; Konfirmity lists CVSS 4.0 9.2. No CVSS vector was available, so cvss_score is left null.
Cloudflare released two WAF rules on 2026-10-25, default action Log: one matching requests with Content-Encoding: br (rule ID ending ca706f3c) and one targeting the Next.js image optimizer path /_next/image (rule ID ending 402fe5bb). Cloudflare warns that existing action overrides could cause the new rules to block legitimate traffic immediately. Because the Content-Encoding: br rule is broad, it will match legitimate Brotli request bodies. No threat actor attribution, network IOCs or C2 infrastructure are reported; no network IOCs existed to check against BeaconBeagle.
MITRE ATT&CK techniques used in TL-2026-4481
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
Affected products and versions in Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
- OpenJS Foundation — Node.js
Vulnerable versions: 22.x < 22.23.4; 24.x < 24.22.1; 26.x < 26.12.1
Fixed in: 22.23.4; 24.22.1; 26.12.1 - Google — Brotli (bundled or system-linked decoder)
Vulnerable versions: Builds predating upstream commit 0ed4268
Fixed in: Builds including upstream commit 0ed4268
Remediation for Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
Patches
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
- Builds linking system Brotli: use a version including upstream google/brotli commit 0ed4268
Immediate actions
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1
- Rebuild applications packaged as single executables or snapshots against the patched runtime
- Enable the Cloudflare WAF rules for Content-Encoding: br (ca706f3c) and /_next/image (402fe5bb) after reviewing action overrides that could cause immediate blocking of legitimate traffic
- Reject or avoid decompressing Brotli request bodies from untrusted clients until patched
Workarounds
- Strip or block Content-Encoding: br on inbound requests at the edge or reverse proxy
- Avoid fetch() to untrusted HTTPS endpoints on unpatched runtimes (Accept-Encoding: identity does not prevent a malicious server replying with br)
Longer-term hardening
- Migrate off end-of-life Node.js 20 and older to 22 or 24
- Inventory all runtimes, containers and system packages that bundle or link google/brotli
- Monitor for Brotli-encoded request bodies and unexpected child processes spawned by Node.js services
CVEs associated with Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
Weaknesses (CWE) in Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
Timeline of Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
- Node.js 20 reaches end of life; it will receive no fix for CVE-2026-111497.
- Node.js ships 22.23.4, 24.22.1 and 26.12.1 fixing 10 CVEs including High-rated CVE-2026-111497 (Brotli out-of-bounds write, cherry-picked upstream patch).
- Per Konfirmity, Imperva demonstrates code execution via a Brotli response fetched with fetch() and a Brotli request body handled by Express/body-parser; Node.js 24.22.1 rejects the input.
- As of this date no in-the-wild exploitation is reported (Konfirmity); Node.js does not report exploitation.
- Cloudflare releases WAF rules ca706f3c (Content-Encoding: br) and 402fe5bb (/_next/image) in Log mode.
- Cyber Security News reports the Cloudflare emergency WAF update and references Node2Shell exploit coverage.
Sources cited for Node.js Brotli Decoder Out-of-Bounds Write Enabling RCE
- Cloudflare Release Emergency WAF Ruleset Update Following Brotli Vulnerability
- Node.js 22.23.4 (LTS) Security Release
- Node.js 24.22.1 (LTS) Security Release
- Node.js October 2026 Security Release (SecurityOnline)
- Node.js October 2026 Security Releases (Konfirmity)
- Node.js v24.22.1 fixes four HIGH CVEs (Brotli, TLS, DNS)
- Patchstack: Node.js < 22.23.4 Remote Code Execution (CVE-2026-111497)
- Node.js Fixes 10 Flaws, 4 High, on the Same Day as PHP
Detection coverage for TL-2026-4481
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4481 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.