CVE-2026-111497, nicknamed Node2Shell (also Broccoli2Shell or Brotli2Shell), is an out-of-bounds write in the decoder of Brotli, Google's open-source compression library. Malformed compressed data makes the decoder keep writing past the end of an eight-byte internal buffer. An attacker who can get an application to decompress their Brotli data can crash the process, read process memory or, in the worst case, run code remotely without logging in. Google scores it 9.2 and Singapore's CSA lists 9.8; Node.js itself rates it High.
It is being exploited. Node.js disclosed and fixed the flaw on 21 October 2026, and public proof-of-concept exploits appeared on GitHub soon after. CISA added it to its Known Exploited Vulnerabilities catalog on 27 October, with a 10 November deadline for US federal agencies. ELLIO reported exploit traffic from an IP address previously used for PHP2Shell attacks and VPN probing, which it called a sign of "an operator focused on mass exploitation". On 30 October Singapore's CSA issued an alert saying the flaw is reportedly being actively exploited. Sources have not published details on victims.
Who is affected: Node.js 22.x, 24.x and 26.x before 22.23.4, 24.22.1 and 26.12.1; end-of-life lines (20.x, 23.x, 25.x and older) get no fix. Akamai says 61% of the networks it sees run affected Node.js versions. You don't need to call the Brotli API yourself: the built-in fetch() decompresses Brotli responses, and Express 5 / body-parser 2 decompress Content-Encoding: br request bodies by default. CSA also lists .NET 8, 9, 10 and 11, and Tenable names Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse as potentially at risk. The Brotli library is fixed in 1.0.10, 1.1.1 and 1.2.1.
WordPress too. Patchstack showed that WordPress, which does not ship Brotli, is still exposed through the server's libcurl: it unpacks Brotli responses before PHP sees them. An unauthenticated pingback.ping request to xmlrpc.php can make a site fetch an attacker's URL. In its lab this crashed PHP workers or pinned the CPU; it did not achieve code execution, and public exploit shells so far target Node.js and Bun. Patchstack notes the official wordpress:latest image still shipped a vulnerable package at the time.
The fix had been sitting in Brotli's public code since 27 February 2026 with no release or advisory, according to Help Net Security. There is no reliable in-app workaround for Node.js: updating is the fix.
