Node2Shell (CVE-2026-111497): Inside the Brotli Decoder Flaw That Threatens Every Cloud-Native Stack
Executive Summary
Executive Summary On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a CVSS v4.0 9.2-rated out-of-bounds write in the Brotli decoder library bundled across Node.js, Bun, .NET, Python, Envoy, Istio, and PHP for Windows. Dubbed Node2Shell, the unauthenticated flaw allows an attacker to deliver malicious Brotli-compressed data via inbound HTTP request bodies or outbound fetch() responses, potentially achieving remote code execution, memory disclosure, or denial of service. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10 federal deadline. Honeypot telemetry confirms active exploitation attempts, and public proof-of-concept code emerged within hours of disclosure.
Node2Shell underscores the systemic risk of shared compression libraries embedded across heterogeneous runtimes and service meshes. As cloud-native architectures proliferate—spanning Kubernetes clusters, Envoy-based service meshes, and polyglot microservices—a single upstream library flaw can simultaneously affect dozens of independent stacks, dramatically expanding the blast radius and complicating coordinated patch response.
Why This Matters Now
Why This Matters NowCVE-2026-111497 is actively targeted, carries a 9.2 CVSS v4.0 score, and affects runtimes spanning Node.js, .NET, Python, Envoy, and Istio simultaneously. CISA's KEV listing with a November 10, 2026 federal deadline, combined with public proof-of-concept code released within hours of disclosure, means organizations have a narrow window before widespread exploitation of production systems begins.
Attack Path Analysis
Attack Path AnalysisAn attacker targeting internet-facing Node.js or Brotli-enabled services crafts a malicious Brotli-compressed payload and delivers it via an inbound HTTP request body or a compromised outbound fetch response, triggering CVE-2026-111497 to achieve remote code execution inside the Node.js process. Post-exploitation, the attacker escalates to root if the container runs as root by default, moves laterally to adjacent workloads, establishes reverse-shell command-and-control, exfiltrates sensitive data, and causes denial-of-service or ransomware-style impact through repeated worker crashes or destructive commands.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker sends an HTTP request with Content-Encoding: br containing a crafted Brotli stream that triggers the out-of-bounds write in the vulnerable decoder bundled with Node.js (CVE-2026-111497). Alternatively, a malicious or compromised upstream server returns a hostile Brotli-compressed response to a server-side fetch() call. Honeypot telemetry from ELLIO and Previdian confirms exploitation attempts against internet-facing Node.js 24.22.0 services beginning October 26, 2026. Public proof-of-concept code was available within hours of disclosure, and Imperva demonstrated code execution on the official arm64 image via both fetch() and Express 5 request bodies.
Related CVEs
Related CVEsCVE-2026-111497
CVSS 9.8An out-of-bounds write vulnerability in the Brotli decoder bundled with Node.js and other runtimes allows an unauthenticated remote attacker to cause a crash, disclose process memory, or achieve remote code execution by supplying a maliciously crafted Brotli-compressed data stream.
Affected Products:
Node.js Foundation Node.js – 22.x < 22.23.4, 24.x < 24.22.1, 26.x < 26.12.1, 20.x (all versions, no fix), 23.x (all versions, no fix), 25.x (all versions, no fix)
Google Brotli – >= 1.0.3, <= 1.0.9, 1.1.0, 1.2.0
Oven Bun – >= 1.0.21, <= 1.4.3
Microsoft .NET – 8.x < 8.0.33, 9.x < 9.0.22, 10.x < 10.0.14, 11.x < RC3
PHP Group PHP for Windows – 8.2.x < 8.2.35-1, 8.3.x < 8.3.36-1, 8.4.x < 8.4.27-1, 8.5.x < 8.5.12-1
Python Software Foundation Python Brotli / brotlicffi – brotlicffi <= 1.2.0.2
Envoy Proxy Envoy – 1.36.x < 1.36.12, 1.37.x < 1.37.8, 1.38.x < 1.38.6, 1.39.x < 1.39.3
Istio Istio – 1.29.x < 1.29.9, 1.30.x < 1.30.6, 1.31.x < 1.31.2
Exploit Status:
active scanning observedReferences:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releaseshttps://www.cisa.gov/known-exploited-vulnerabilities-cataloghttps://www.sentinelone.com/blog/stopping-node2shell-sentinelone-protects-customers-from-brotli-based-RCE/https://github.com/google/brotli/releases/tag/v1.0.10https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploit Public-Facing Application
Exploitation for Client Execution
Command and Scripting Interpreter: Unix Shell
Ingress Tool Transfer
Exploitation for Privilege Escalation
System Information Discovery
Application Layer Protocol: Web Protocols
Endpoint Denial of Service: Application or System Exploitation
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Vulnerability Management and Incident Response
Control ID: Section 500.7 / 500.16
DORA (Digital Operational Resilience Act) – ICT Risk Management and Threat-Led Penetration Testing
Control ID: Article 9 / Article 19
CISA Zero Trust Maturity Model 2.0 – Application Workload Isolation and Runtime Integrity
Control ID: Application Pillar — Application Security / Workload Security
NIS2 Directive – Vulnerability Handling, Patch Management, and Supply Chain Security
Control ID: Article 21 — Cybersecurity Risk Management Measures
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities and Software Installation on Operational Systems
Control ID: Annex A 8.8 / 8.19
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Node2Shell's CVE-2026-111497 RCE flaw in Brotli-dependent Node.js, Envoy, and Bun runtimes directly threatens IT infrastructure, exposing unauthenticated remote code execution, lateral movement, and exfiltration risks across cloud-native deployments.
Financial Services
Express 5 and fetch-based Brotli decompression vulnerabilities risk unauthenticated RCE against financial APIs; PCI 4.0 and NIST 800-53 compliance obligations around egress control and east-west segmentation amplify remediation urgency significantly.
Health Care / Life Sciences
HIPAA-regulated healthcare platforms running Node.js or .NET with Brotli decompression face unauthenticated RCE and memory disclosure risks, threatening patient data confidentiality under HIPAA 164.312 and NIST CSF PR.DS-2 controls.
Internet
Internet-facing Express 5 services and server-side fetch pipelines are primary Node2Shell attack surfaces; CISA KEV listing and honeypot-confirmed exploitation attempts signal imminent risk to web platform operators handling attacker-controlled Brotli-compressed traffic.
Sources
Sources- Stopping Node2Shell: How SentinelOne Protects Customers From Brotli-Based Remote Code Executionhttps://www.sentinelone.com/blog/stopping-node2shell-sentinelone-protects-customers-from-brotli-based-RCE/Verified
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-111497https://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Node.js October 2026 Security Releaseshttps://nodejs.org/en/blog/vulnerability/october-2026-security-releasesVerified
- Microsoft Security Response Center - CVE-2026-111497 .NET Out-of-Band Updatehttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497Verified
- Google Brotli 1.0.10 Release Noteshttps://github.com/google/brotli/releases/tag/v1.0.10Verified
- Imperva Research: Node2Shell Code Execution Demonstration on arm64https://www.imperva.com/blog/node2shell-brotli-rce-cve-2026-111497
- Sysdig Threat Research: Node2Shell Crash Reproduction and Exploit Timelinehttps://sysdig.com/blog/node2shell-cve-2026-111497-brotli-rce
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attacker depends on unrestricted inbound access, uncontrolled east-west paths, and open egress to progress from initial exploitation through exfiltration. By enforcing workload-scoped segmentation, identity-aware routing, and controlled egress policy, CNSF would likely reduce the attacker's reachability and constrain the blast radius across each stage of this intrusion.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Perimeter-aware traffic inspection across the CNSF fabric would likely reduce the reachability of the vulnerable Node.js service to only authorized sources, making it harder for opportunistic internet-based exploit attempts to reach the workload without passing through policy-enforced ingress controls.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation enforcing least-privilege identity policy would likely constrain the compromised process to a scoped service identity, reducing the range of filesystem paths, credentials, and network destinations reachable from within the exploited container even if root-level execution is achieved.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the compromised Node.js workload's ability to initiate connections to adjacent services it has no legitimate business reason to reach, reducing the attacker's lateral movement surface across the internal network fabric.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility across outbound traffic flows would likely surface unexpected connections from the Node.js workload to attacker-controlled infrastructure, allowing policy-driven responses to constrain or alert on reverse-shell and implant download activity that falls outside normal service behavior.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security with FQDN-based filtering would likely deny outbound connections from the compromised workload to unauthorized external destinations, reducing the attacker's ability to complete data exfiltration over novel or unrecognized outbound channels.
With segmentation and egress controls reducing the attacker's ability to move laterally or exfiltrate broadly, the likely remaining impact would be scoped to availability disruption of the specific Node.js service rather than widespread workload destruction or large-scale data loss across the environment.
Impact at a Glance
Affected Business Functions
- Web Application and API Services (Node.js/Express 5 backends)
- Content Delivery and Reverse Proxy Infrastructure (Envoy, Istio service mesh)
- Developer Toolchain and CI/CD Pipelines (Bun, .NET, PHP for Windows build images)
- Server-Side Data Fetching and Webhook Processing (fetch() outbound integrations)
Estimated downtime: 7 days
Estimated loss: N/A
Process memory disclosure is a confirmed potential outcome, which may expose in-memory secrets such as session tokens, API keys, database credentials, private keys, and personal data of active users processed by the vulnerable Node.js service. Remote code execution could enable full compromise of the host or container, lateral movement, and exfiltration of application data stores. Repeated crashes constitute a denial-of-service condition against any internet-facing service decoding attacker-controlled Brotli streams. End-of-life Node.js 20, 23, and 25 deployments have no patch path and remain permanently exposed until migrated.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately upgrade all Node.js workloads to 22.23.4, 24.22.1, or 26.12.1 and rebuild container images; migrate off end-of-life lines 20, 23, and 25 which will receive no patch, then extend patching to Bun, .NET, Python Brotli, Envoy, Istio, and PHP for Windows across all environments including CI/CD and developer machines.
- • Deploy Cloud Firewall (ACF) and proxy-layer rules to block or reject inbound HTTP requests carrying Content-Encoding: br until all vulnerable Brotli decoders are confirmed patched, and set body-parser inflate to false as a stopgap to return HTTP 415 for compressed request bodies.
- • Enforce Zero Trust Segmentation with least-privilege service identities to ensure Node.js and Brotli-enabled workloads run as non-root users with minimal filesystem, network, and IAM permissions, limiting blast radius if exploitation succeeds.
- • Apply East-West Traffic Security controls to enforce workload-to-workload microsegmentation and prevent a compromised Node.js container from reaching adjacent internal services, databases, or cloud metadata endpoints through uncontrolled lateral paths.
- • Activate Egress Security & Policy Enforcement with FQDN filtering and Multicloud Visibility & Control to detect and block unauthorized outbound connections from Node.js service accounts to attacker C2 infrastructure, and ingest web server and CDN logs into SIEM to alert on spikes in HTTP 5xx responses correlated with worker restarts as an early signal of exploitation attempts.
