> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Node2Shell Brotli flaw triggers critical patching across Microsoft, Node.js, and Python ecosystems
- URL: https://f4n6.co.uk/security-feed/node2shell-brotli-flaw-triggers-critical-patching-across-microsoft-node-js-and-python-ecosystems/
- Published: 2026-10-26T13:43:38.000Z
- Updated: 2026-10-26T13:43:38.000Z
- Author: Jeff Davies
- Tags: #security-feed

## 1\. Executive summary

An out-of-bounds write in Google's Brotli decoder, tracked as CVE-2026-111497 and nicknamed Node2Shell, affects Brotli versions 1.0.3 through 1.2.0 and reaches any application, server, proxy, or runtime that decompresses attacker-supplied Brotli data. Imperva demonstrated working remote code execution against the official Node.js 24.22.0 Linux arm64 image with no debugger or custom build, and Node.js shipped fixes for its 22.x, 24.x and 26.x lines on 21 October 2026\. Patches have since landed for the Python Brotli and brotlicffi packages, Bun, Envoy and Istio, with more downstream projects expected to confirm impact. No CVSS score, CISA KEV entry or exploitation-in-the-wild report is available for this CVE, so the current risk is exposure-driven: any EMEA financial services estate running an unpatched Brotli decoder in an internet-facing or data-ingesting path is exposed to unauthenticated memory corruption. The proof of concept is public and the affected component is embedded in build tooling, service meshes and language runtimes that are rarely inventoried as separate assets.

## 2\. Regulatory framing

| Article      | Trigger (the fact in this item)                                                                                                                                                                                         | Practical impact                                                                                                                                                                                                                                                    |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 28 | The flaw sits in a third-party library (Google Brotli) embedded in Node.js, .NET, PowerShell, Python, Bun, Envoy and Istio, so exposure is inherited from ICT third-party components rather than from first-party code  | Clients must be able to identify which third-party components in their ICT estate bundle an affected Brotli version and obtain fix status from those providers; contracts and component inventories that do not record embedded library versions cannot answer this |
| DORA Art. 30 | Fix availability is staggered across providers (Node.js patched 21 October 2026; Python, Bun, Envoy and Istio later; others still to confirm), so remediation depends on each provider's release cadence and disclosure | Contractual provisions on patch timelines, vulnerability notification and support for incident response determine how quickly a client can close exposure in components it does not maintain itself                                                                 |

## 3\. Technical analysis & attack chain

The flaw is a buffer overflow in the Brotli decoder source file c/dec/decode.c, present in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. A crafted Brotli-compressed stream causes the decoder to write past the end of its output buffer, corrupting adjacent decoder state memory. The GitHub advisory states the consequences as corruption of adjacent memory, disclosure of sensitive memory contents, denial of service, and potentially arbitrary code execution. Exploitation requires no authentication: the attacker only needs the target to decompress data they control.

Confirmed steps, as demonstrated or stated by the sources:

1. The attacker crafts a Brotli-compressed stream that overruns the decoder's output buffer during decompression.
2. The stream is delivered to any code path where the target application decompresses attacker-supplied Brotli data. The sources do not specify a single delivery vector; the exposure is the decompression call itself.
3. On decompression, the out-of-bounds write corrupts adjacent decoder state memory.
4. Imperva's Node2Shell proof of concept achieved code execution on the official Node.js 24.22.0 image for Linux arm64, using the Brotli decoder bundled with Node.js, with no debugger and no custom build.

Affected and patched components named in the sources:

- Google Brotli library: versions 1.0.3 through 1.2.0 affected. Fixed in 1.0.10, 1.1.1 or 1.2.1.
- Node.js: all three supported lines (22.x, 24.x, 26.x) received security updates on 21 October 2026 covering 10 flaws, with the Brotli decompression bug rated the most serious and described by the project as allowing remote code execution. Each supported line has one fixed version; the sources do not name the specific version numbers.
- PyPI Brotli package and brotlicffi: affected, per the GitHub advisory and The Hacker News.
- Bun JavaScript runtime, Envoy proxy (where configured to decompress Brotli), and the Istio traffic management platform: patches rolled out, per Risky Business News.
- .NET and PowerShell: named by SecurityWeek as affected; the related sources give no version detail for either.

The practical difficulty is inventory, not exploitation technique. Brotli is a compression format embedded in runtimes, proxies and package dependencies rather than a standalone service, so the vulnerable code is present wherever a bundled decoder is older than the fixed release. Risky Business News reports that many further projects are expected to confirm impact and ship fixes over the coming months, which means the patch wave will continue after this advisory.

Attribution and provenance: Node.js credited Khai Tran and Sylvie Mayer of the OpenAI Codex Security team with finding the flaw, and Risky Business News states the bug was found using AI tools. There is no threat actor attribution in any source and no report of exploitation in the wild. The Imperva work is a proof of concept, not an observed campaign.

Confidence caveats: the affected-version range and fixed versions rest on the GitHub advisory (GHSA-9v8h-qqgm-4m35). The Node.js fix date and the RCE rating rest on The Hacker News reporting of the Node.js disclosure. The Bun, Envoy and Istio patch status is single-sourced to Risky Business News and should be verified against each project's own advisory before it is used for remediation sign-off. The .NET and PowerShell impact is stated only in SecurityWeek's summary line and is not corroborated by any related source; treat it as unconfirmed pending vendor advisories.

Naming: the same CVE has been published under Node2Shell, HTTPS2Shell, Brocolli2Shell and Brotlipocalypse. Use CVE-2026-111497 in tickets and detection content so that vendor advisories and scanner output reconcile.

## 4\. Mitigation & containment

P1 (within 24 hours)

- Inventory every runtime, proxy, service mesh component and application dependency that decompresses Brotli data, and record the bundled Brotli version. Trail of Bits released a tool to audit code for Brotli processing paths; use it on first-party codebases to find decompression call sites.
- Upgrade Node.js to the fixed release for each line in use (22.x, 24.x, 26.x) from the 21 October 2026 security release. Confirm the deployed container base images and CI build images, not only host installs; the Imperva proof of concept ran against the official Node.js 24.22.0 Linux arm64 image.
- Upgrade the PyPI Brotli package and brotlicffi to a fixed release, and Google Brotli itself to 1.0.10, 1.1.1 or 1.2.1\. Pin these versions in dependency manifests and lockfiles so rebuilds do not reintroduce 1.0.3 through 1.2.0.
- Where an affected component sits on an internet-facing path and no fixed version exists yet, disable Brotli decompression for untrusted input at the proxy or application layer (for example, restrict Envoy to gzip or identity encoding for client-supplied bodies) until the vendor fix is available.

P2 (within 72 hours)

- Verify Bun, Envoy and Istio patch status against each project's own advisory rather than relying on press coverage, and apply the fixed releases.
- Obtain .NET and PowerShell impact statements from Microsoft. SecurityWeek names both as affected; no related source confirms versions or fixes, so do not close these items on the basis of this advisory alone.
- Add a build-time check that fails CI when a Brotli dependency resolves to a version in the range 1.0.3 through 1.2.0.

P3 (within 7 days)

- Re-scan the estate for newly published downstream advisories. Risky Business News reports more projects will confirm impact in the coming months, so schedule a recurring check rather than a one-off sweep.
- Review SBOM coverage for embedded compression libraries. If the SBOM does not record transitive Brotli versions, this CVE is a sample of what the inventory cannot answer.

## 5\. Indicators of compromise

No indicators of compromise available in the source material. No hashes, domains, IP addresses, file paths or command lines are published in any related source. The Imperva proof of concept is described but its payload is not disclosed.

Behavioural indicators:

| behaviour                                                                                        | where to observe                                                                                | confidence                                                                             |
| ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Process crash or memory corruption fault during Brotli decompression of externally supplied data | Application error logs, core dumps, crash telemetry on Node.js, Bun, Python and Envoy workloads | Medium (derived from the out-of-bounds write mechanism; no atomic indicator published) |
| Unexpected code execution in a process whose only external input is a compressed request body    | EDR process telemetry on internet-facing Node.js and proxy hosts                                | Low (proof of concept only; no in-the-wild observation reported)                       |

## 6\. Detection

Insufficient indicators to author detection rules. The sources describe the vulnerability mechanism but publish no distinctive strings, command-line flags, file names, registry keys or network artefacts belonging to an exploit. A YARA or Sigma rule built from the CVE identifier or product names would detect reporting about the flaw, not the flaw. Detection effort should go to version inventory (see §4) until a proof-of-concept payload or vendor detection content is published.

## 7\. Sources

- GitHub Security Advisories, "Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package", GHSA-9v8h-qqgm-4m35, https://github.com/advisories/GHSA-9v8h-qqgm-4m35
- The Hacker News, "Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data", https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html
- The Hacker News, "Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software", https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html
- The Hacker News, "Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions", https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html
- Risky Business News, "Risky Bulletin: While everyone was looking at PHP, another RCE is wrecking what's left of the internet", https://news.risky.biz/risky-bulletin-while-everyone-was-looking-at-php-another-rce-is-wrecking-whats-left-of-the-internet/
- SecurityWeek, "Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages", 2026-10-26, https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/

## 8\. Adverse Trace position

No CVSS score, CISA KEV entry or exploitation-in-the-wild report exists for CVE-2026-111497, so Adverse Trace does not rate this as an actively exploited emergency. The exposure is nonetheless broad and the proof of concept is public: unauthenticated code execution against a stock Node.js image means any internet-facing decompression path running an unpatched decoder is a candidate target, and the same code is embedded in proxies, service meshes and language packages that most inventories do not track at library-version granularity. We assess the .NET and PowerShell impact as unconfirmed (single-sourced to SecurityWeek) and the Bun, Envoy and Istio patch status as single-sourced to Risky Business News; clients should verify both against vendor advisories before closing remediation items. We will track downstream advisories as further projects confirm impact, and will reissue this note if a CVSS score, KEV listing or in-the-wild exploitation report appears. Clients should treat the P1 inventory and version-pinning steps as the immediate action, because the patch wave will continue after this advisory is issued.

---

[Read the original source →](https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*