www.it-connect.fr
Node2Shell: The Brotli Flaw Exposing Node.js to Remote Code Execution
Node2Shell is the name of the new major security flaw patched in Node.js. A single compressed Brotli HTTP response can be enough to execute malicious code in your Node.js application. Here’s what you need to know about this threat.
Should we fear an impact as serious as PHP2Shell? The name is indeed in the same style: PHP2Shell, Node2Shell... enough to be alarming. Still, no, that is not the case at all. Although this flaw is dangerous, it does not affect all Node.js applications.
On October 21, 2026, the Node.js project released security updates for its three currently maintained branches: Node.js 22.23.4, 24.22.1, and 26.12.1. The goal of these updates? To patch 10 vulnerabilities, including 4 rated high severity. Among them, the most serious is CVE-2026-111497: an out-of-bounds write in the Brotli decoder. And according to the security bulletin, this flaw "allows remote code execution".
As a reminder, Brotli is Google’s compression library, widely used to reduce web traffic size. Node.js ships its own copy of this code, and that is what is vulnerable, not Node.js code itself. A malformed compressed input can cause the decoder to write beyond the end of a memory buffer. The fix is a commit from the Brotli project dated February 2026, now integrated by Node.js.
This wave of fixes also updates the certificate store embedded in Node.js, which lets me connect it to the matter of the trivial private keys of eight eMudhra intermediate certificates, which I mentioned yesterday.
Node2Shell: Code Executed on the Official Image
The name Node2Shell was coined by Imperva’s Red Team (Thales group). In its analysis published on October 22, Ron Masas explains that he managed to get code executed in a Node.js application by sending it booby-trapped Brotli data. The test targeted the official Node.js 24.22.0 image.
According to him, two scenarios work: the application downloads a booby-trapped response with fetch(), or it receives a booby-trapped request via Express 5 or body-parser 2. The fixed 24.22.1 version, on the other hand, rejects this data.
There is, however, one caveat. "Execution required several attempts in our setup", Imperva notes. The attack therefore does not succeed every time, and it was only demonstrated on Linux arm64. An exploit code was also published on GitHub on October 22, but according to The Hacker News, cited by Aikido, it would only work on a Node.js version deliberately configured in a certain way. To date, no real-world attack has been reported.
Who Is Affected and How Can You Protect Yourself?
Any Node.js application that decompresses Brotli data controlled by an attacker is exposed. That said, this is a specific condition, which is not trivial, and it also widens the gap with PHP2Shell. According to Aikido, this covers at least three cases:
- Express 5 and body-parser 2.x servers: they decompress request bodies sent with the
Content-Encoding: brheader, and any client can send one. - Applications that call external servers:
fetch()automatically decompresses Brotli responses. Webhooks and functions that call a user-provided URL are targets. - Code that uses node:zlib directly: especially the
brotliDecompressandcreateBrotliDecompressfunctions applied to untrusted data.
The only real fix is to update Node.js to version 22.23.4, 24.22.1, or 26.12.1 (or newer). Branches 25.x, 23.x, 20.x, and earlier are end of life: they will not receive a fix. On the Bun side, version 1.4.4 released on October 22 includes the correction.
Good luck!
