Critical Brotli Decoder Vulnerability: Are you affected and what should you do?

Tracked as CVE-2026-111497 and commonly referred to as Node2Shell, the vulnerability affects a range of technologies that use Google’s Brotli library, including Node.js, Python packages, .NET, Bun, Envoy and Istio. Updates are available for many affected products.

A public proof of concept is available, and researchers have demonstrated code execution on an unmodified Node.js build. While exploitation in the wild had not been reported as of 26 October 2026, organisations should identify affected systems and prioritise remediation, particularly where vulnerable services are accessible from the internet.

What is the Brotli vulnerability?

Brotli is a compression technology used across a range of applications and software platforms. The vulnerability occurs when affected software decodes specially crafted Brotli data supplied by an attacker.

Successful exploitation can cause the software to write data outside its allocated memory. In the most serious scenario, this could allow an attacker to execute their own code with the same permissions as the affected application. The vulnerability could also expose information held in memory or cause the service to crash.

Importantly, simply running software that includes Brotli does not automatically mean a system can be exploited. Exposure occurs where vulnerable software decodes Brotli data that an attacker can control, such as compressed request bodies or responses fetched from attacker-controlled servers.

Which systems are affected?

The vulnerability extends beyond Node.js because the underlying flaw exists within Google’s Brotli library.

The technical advisory identifies affected or potentially affected technologies including:

• Node.js: 22.x before 22.23.4, 24.x before 24.22.1 and 26.x before 26.12.1.
• Python: Applications using vulnerable versions of the Brotli or brotlicffi packages.
• Other technologies: Fixes have also been released for products including Bun, Envoy, Istio, Java brotli4j and .NET.
• Applications that bundle Brotli: Some software includes its own copy of the decoder and therefore requires a product-specific update rather than simply updating the underlying operating system.

Node.js versions 25, 23, 20 and earlier are end of life and will not receive a fix, meaning organisations still using these versions should move to a supported release.

The position also varies across individual software products and Linux distributions, so organisations should check the latest security guidance from each relevant vendor rather than assuming a wider system update has resolved the issue.

What should organisations do now?

1. Identify where Brotli is being used

Start by identifying Node.js runtimes, Python environments, container images and other products that may include the Brotli decoder. Prioritise systems that are accessible from the internet.

Organisations should also consider applications and appliances that bundle their own copy of Brotli, as these may require a separate vendor update.

2. Apply the appropriate updates

For Node.js, update affected systems to 22.23.4, 24.22.1 or 26.12.1, depending on the release line in use.

Python environments should update Brotli to 1.2.1 and brotlicffi to 1.2.1.0. Container images should then be rebuilt and affected services redeployed or restarted so that running workloads use the patched code.

3. Check software supplied by third parties

The vulnerability affects more than individual Node.js and Python installations.

Organisations should review products that decode compressed data, including proxies, gateways, data and analytics tools, archive utilities and appliances. Where software bundles its own Brotli library, check with the vendor to establish whether it is affected and whether a security update has been released.

4. Prioritise exposed services

Particular attention should be given to services that accept compressed request bodies or retrieve URLs supplied by users, including services such as link previews, webhooks and crawlers.

Where an affected system cannot immediately be patched, the technical guidance recommends rejecting requests using Brotli Content-Encoding at the reverse proxy, load balancer or WAF while remediation is completed. This does not protect every possible route to exploitation, particularly where applications themselves retrieve external content.

Is the vulnerability being actively exploited?

A public proof of concept appeared shortly after the fix became available. The advisory also reports that Imperva researchers achieved code execution against an unmodified Node.js 24.22.0 build, although their exploit had not been publicly released.

As of 26 October 2026, the technical advisory states that exploitation in the wild had not been reported and the vulnerability was not included in the CISA Known Exploited Vulnerabilities catalogue.

The existence of public proof-of-concept material means organisations should nevertheless avoid unnecessary delays in identifying and remediating exposed systems.

Concerned your organisation may be affected?

If you are unsure whether Brotli is present within your environment, the first step is to establish where affected runtimes, libraries and applications are being used and whether those systems can process attacker-controlled Brotli data.

Zensec can help organisations identify potentially affected systems, assess exposure and establish where remediation should be prioritised.

If you are affected, or don’t know whether you are, contact the Zensec team for support.