KIungefiltert

· 4 min read · Auf Deutsch lesen

Node2Shell: Brotli flaw hits Node.js, .NET, Python and Bun, and is now on CISA's exploited list

An out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2) affects Node.js, .NET, PowerShell, Python packages and Bun. CISA reports exploitation. Patches are out.

securityself-hosting

Translated from the German original with an AI language model, approved by me. Read the original

Brotli is a compression format from Google. You run into it wherever HTTP responses or files get squeezed down. Its decoder has a memory bug, and because so many runtimes ship the same C code, a lot of people now have patching to do. I flagged this briefly on X and in the WhatsApp channel. Quite a bit has changed since then, so here is the full version.

What happened

The flaw now has an ID: CVE-2026-111497. It is known as "Node2Shell", and depending on the source also as HTTP2Shell, Broccoli2Shell or Brotli2Shell. It is an out-of-bounds write: the program writes data past the end of a reserved memory area and overwrites whatever sits behind it. According to Brandefense and other analyses, the decoder treats a certain invalid stream as "need more input" instead of a format error. It then keeps adding data to an internal eight-byte buffer and writes past the end of it.

The impact ranges from crashes to leaking process memory to running attacker code. Google scores the flaw 9.2 under CVSS 4.0 (critical). Microsoft gives it 8.1 under CVSS 3.1 and rates exploitation as "more likely" (SecurityWeek).

Brotli versions 1.0.3 through 1.2.0 are affected on all platforms. OpenAI Codex Security found the bug. According to OpenAI, the actual fix had been in the Brotli source since February but wasn't treated as a security fix back then. A new release only shipped now.

What changed since my post

When I posted, nobody knew whether the flaw was being exploited. That has moved: the US agency CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) catalog on October 27. US federal agencies must patch by November 10. CISA hasn't said who is attacking or how.

So far, the public evidence is attack attempts against honeypots, which are decoy systems set up to log attacks. ELLIO logged a malicious request against Node.js 24.22.0 on October 26. ELLIO says the exploit was broken and produced no shell in 50 tests. Previdian logged an attempt on October 27 and stressed that this does not mean it succeeded. No successful break-ins on production systems have been reported publicly.

The lab results are a different story. Imperva achieved code execution on the official Node.js image, though not on every attempt. Public proof-of-concept (demo) exploits exist. People are still arguing over whether the bug realistically leads to code execution or mostly causes crashes. In practice it doesn't matter: you have to patch either way.

Who is affected

You're only exposed if you decode Brotli data from an untrusted source. That could be compressed HTTP request bodies, responses from servers you don't control, or compressed files. A bare Node.js HTTP server doesn't do this by itself, but middleware such as Express 5 or body-parser 2 does. In .NET the path is off by default. It runs through ASP.NET Core request decompression, HttpClient automatic decompression, or direct use of BrotliStream/BrotliDecoder. Apache and Nginx are considered unaffected in their default configurations.

Patched versions according to SecurityWeek and heise:

  • Brotli: 1.0.10, 1.1.1, 1.2.1
  • Node.js: 22.23.4, 24.22.1, 26.12.1 (since October 21). Older end-of-life lines get no official fix.
  • Python: Brotli 1.2.1 and brotlicffi 1.2.1.0
  • .NET: 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC 3 (since October 25), plus Visual Studio 2019, 2022, 2026
  • PowerShell: 7.4, 7.5 and 7.6 with current updates
  • Bun, Envoy and Istio have shipped updates too.

According to the broccoli2shell.com tracker, DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II are still unpatched. Broadcom also lists VMware SDDC Manager as affected, with patches still pending. Java, PHP, Ruby and Go bindings that wrap the C library may be affected as well.

What you should do

  1. Update runtimes: bring Node.js, Bun, .NET and PowerShell up to the versions above.
  2. Check dependencies: search Python projects for Brotli and brotlicffi, including as transitive dependencies. Do the same for Brotli bindings in other languages.
  3. Restart services: running processes keep using the old code until they restart.
  4. Rebuild container images on a patched base image. Updating the host doesn't fix the container.
  5. Turn off Brotli decoding for now if you can't update yet. Aikido has guidance on this.

My take: so far there are only honeypot attempts and no confirmed break-ins. Still, a KEV listing, public PoCs and lab code execution are reason enough not to leave this for the next maintenance window. If you run Node.js services with Express or .NET APIs with request decompression yourself, get it done this week.

Sources