Key points
▶ A critical vulnerability in Node.js, a widely used environment for web server development, was patched on October 21. Security firm Aikido Security said on October 23 that the “Node2Shell” flaw (CVE-2026-111497) stems not from Node.js itself, but from a bug in Google’s Brotli data-compression technology.
▶ When a program decompresses data deliberately crafted to violate the format specification, it can write beyond its permitted memory area.
▶ The flaw can allow an attacker to crash a server or read its memory without logging in, and, under certain conditions, execute code remotely.
▶ Google Brotli versions 1.0.3 through 1.2.0 are affected. The issue was fixed in version 1.2.1.
A critical security vulnerability found in Node.js web server software was not a problem with Node.js alone.
In an analysis report published on the 23rd, security firm Aikido Security said the Node.js vulnerability known as “Node2Shell” (CVE-2026-111497) originated in a flaw in Brotli’s decompression function. Brotli is a data-compression technology developed by Google.
Further investigation found the same flaw in a compression library for Python, Envoy—a proxy for web communications—and Bun, a JavaScript runtime.
Aikido said the impact extends beyond Node.js to HTTP communications software more broadly, and named the vulnerability “HTTP2Shell.” On the 23rd, the Korea Internet & Security Agency (KISA) issued an advisory recommending that users update Node.js.
◆ Decompression writes beyond memory bounds
Brotli is a compression technology that reduces the size of web page text and program code so they can be sent over the internet more quickly. The receiving server or browser decompresses the data to restore its original content, but a flaw affected this process.
Decompression software processes incoming data on the assumption that it follows the required format. If an attacker sends compressed data deliberately crafted to violate that format, the software may fail to reject it and write data outside its permitted memory area.
This can cause a server to crash or expose information in its memory. Under certain conditions, an attacker can execute malicious code remotely. The vulnerability received a CVSS 4.0 score of 9.2, placing it in the highest severity category: “Critical.”
The attack can come from either direction. A malicious client can send malformed compressed data to a server, or a malicious server can send it in a response to attack the program connecting to it. Imperva’s red team demonstrated code execution on an unpatched official build of Node.js 24.22.0.
◆ Updating Node.js alone is not enough
On the 21st, the Node.js team released versions 22.23.4, 24.22.1 and 26.12.1, which fix the Brotli decompression flaw. But the discovery that the vulnerable component was a Brotli library bundled with Node.js broadened the scope of the issue.
Google Brotli versions 1.0.3 through 1.2.0 are affected. The issue was fixed in version 1.2.1, as well as in versions 1.1.1 and 1.0.10 for older branches. According to Aikido, the same vulnerability affected the Python libraries Brotli and brotlicffi, and was fixed in versions 1.2.1 and 1.2.1.0, respectively.
These libraries are included in Python web communication tools such as urllib3, aiohttp and httpx, where they automatically decompress data. As a result, developers may be affected even if they do not use Brotli directly.
Envoy, which proxies communications between web servers and apps, has released fixes including version 1.40.0, while Bun fixed the issue in version 1.4.4. No fixes are available for the end-of-support Node.js 20, 23 and 25 release lines.
Apache mod_brotli and Nginx are not affected under their default configurations because they do not decompress Brotli requests. The attack applies when vulnerable software decompresses compressed data received from outside; not every website that uses Brotli is at risk.
◆ Fixed in February, but left unaddressed for eight months
The flaw had already been discovered in February. According to Aikido, OpenAI found and reported the Brotli decompression flaw that month, and the Google Brotli source code was modified at the time. However, the error was not then recognized as a serious security vulnerability.
Because the corrected code was not released as an official security update, vulnerable versions remained bundled in Node.js, Python libraries and other software for eight months. OpenAI published an advisory about Brotli on the website for its security initiative, “Patch the Planet.”
Security scanning tools also missed the flaw. Aikido said that, as of the 23rd, information about affected Python packages had not been linked in vulnerability databases, so tools such as pip-audit, Dependabot and Safety could not issue warnings.
These tools automatically check whether libraries used by developers have known vulnerabilities. But even when a vulnerability is registered, the tools will not alert users if it is not linked to the affected packages. As of the 25th, no in-the-wild attacks had been reported, and the flaw had not been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.
◆ Check libraries one by one
Fixes have been released for major software. The problem is Brotli bundled inside other programs. Copies embedded in container images, compiled executables and operating system packages must each be updated separately.
Aikido and Upwind recommended first checking externally exposed proxies and services that decompress request bodies, then locating every copy of Brotli in software bills of materials (SBOMs) and images and checking its version. They also advised restarting systems after applying patches. Without a restart, running processes will continue to use the old decoder.
If an immediate patch is not possible, there are temporary measures. At the proxy or middleware layer, operators can reject requests with “Content-Encoding: br” and reject Brotli-encoded responses received from outside before attempting to decompress them.
For Python, if Brotli support is not required, removing the Brotli or brotlicffi package will allow a fallback to gzip or another format. Simply removing “br” from request headers is not enough: a malicious server can send a Brotli response regardless of the request.