CVE-2026-111497 (Node2Shell), explained: the Brotli bug in Node.js, .NET and Envoy, and how to check

Think of a parcel that arrives vacuum-packed. Before you can use what is inside, somebody has to unpack it. On the internet, a lot of data arrives packed this way to save bandwidth, and the program that receives it unpacks it automatically. Brotli is one of the packing formats. Google made it, every major browser and CDN speaks it, and a server says it used it with the header Content-Encoding: br.

The unpacking code is called the decoder. On 22 October 2026 a bug in Google's Brotli decoder was published as CVE-2026-111497. If the packed data is built in a particular broken way, the decoder writes bytes past the end of a small buffer in memory. That overwrites the decoder's own working state. The record says a remote attacker with no login can use this to crash the program, read memory it should not show, or potentially run their own code.

It is not a theoretical bug. CISA, the US cyber agency, added it to its Known Exploited Vulnerabilities list on 27 October and gave US federal agencies until 10 November 2026 to fix it. ELLIO reported exploit traffic reaching its sensors on 26 October and reproduced a shell on official Node.js builds. Researchers call it Node2Shell; a tracking site calls it Broccoli2Shell.

A Brotli stream is split into blocks, and at points the stream tells the decoder to switch to another kind of block. If a stream declares only one kind, a switch is impossible, so a switch request there is simply invalid data and the decoder should reject it.

Before the fix, the helper that read a block switch could only answer yes or no. It answered no for that invalid switch, and also answered no when it had merely run out of input halfway through. The caller treated every no as "send me more input". So the decoder kept accepting more bytes into an eight-byte holding buffer that never drained, and past the eighth byte the writes landed outside it.

That is why the record lists two weaknesses: CWE-252, an unchecked return value, which is the bug, and CWE-787, an out-of-bounds write, which is what it causes. The upstream fix makes the decoder return a hard format error for an invalid block switch, so the stream is rejected instead of fed.

Most bugs need a user to open something. This one sits in code that runs on its own. Node's built-in fetch() unpacks a Brotli reply automatically, so any server your app calls (a webhook target, a link preview, an "import from URL" feature) can send the bad stream back. Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 unpack Brotli request bodies, so any client can send it in. A bare node:http server does not unpack bodies by itself.

In Python, urllib3 (and so requests), aiohttp and httpx with its brotli extra unpack Brotli replies whenever the Brotli or brotlicffi package is installed. Beyond application code, git over HTTPS is exposed when libcurl is built with Brotli support, and anything that reads Brotli inside WOFF2 fonts, archives, Parquet files or firmware sections calls the same decoder.

The copies matter. Node.js ships its own copy of Brotli, so on an official build only the Node.js version decides whether you are fixed. A Node.js from Homebrew or a Linux distribution may load the system Brotli library instead, and then the system package needs the update too. Ports of the decoder to other languages are not affected the same way: the Go port (andybalholm/brotli) had the same logic error but could only crash, and is fixed in 1.2.7.

Compression is usually filed under performance, so it is easy to forget that the decoder is a parser running on bytes someone else chose. Every place your system unpacks data from outside, an HTTP client, a body parser, a proxy filter, an upload pipeline, is part of its attack surface, even though no line of your code mentions Brotli.

Two habits limit the damage next time. Keep an inventory of where decompression happens, including the libraries that do it for you. And keep runtimes on supported lines with a rebuild path that takes minutes, because the fix for this bug was a version number, and the teams that were slow were the ones that could not change it quickly.

Read next: Brotli compression, the lesson