On this page

Node2Shell: update Brotli decoders across your website stack

By Tornike@realtornikeoPublished Nov 4, 2026Last updated Nov 4, 2026

Original sources: Node.js: October security releases; Google Brotli: security releases; Microsoft: .NET advisory; NCSC: exploitation and mitigation

Does this apply to me?

Node.js 22, 24 and 26Before 22.23.4, 24.22.1 and 26.12.1, respectively: An application decompresses attacker-controlled Brotli data.Action: 22.23.4, 24.22.1 or 26.12.1 for the respective branch
Google Brotli1.0.3 through 1.0.9, 1.1.0 and 1.2.0: An application uses the affected decoder on untrusted input. Distributor backports can change package status.Action: 1.0.10, 1.1.1 or 1.2.1 for the respective branch
.NET 8, 9 and 10Before 8.0.33, 9.0.22 and 10.0.14, respectively: Brotli decompression is enabled or used on attacker-controlled input. Microsoft also lists affected .NET 11 previews.Action: 8.0.33, 9.0.22 or 10.0.14 for the respective branch

How severe is it?

High: potential code execution

Memory corruption can cause a crash, disclose process memory or potentially allow code execution. New Zealand's NCSC reports active exploitation; its alert does not establish that a particular website was compromised.

Node.js rates the flaw High. My assessment is that exposed decoders need prompt attention because of the potential impact and reported exploitation.

First reported Oct 21, 2026

CVE-2026-111497

What happened

Node.js disclosed the decoder flaw on October 21. A crafted Brotli stream can write outside an internal buffer and corrupt process memory. The affected decoder also appears in other runtimes and packages.

Exposure requires an application to decompress attacker-controlled Brotli data. That data can arrive in a request body or in a response fetched by the application. Check dependencies and bundled libraries as well as the runtime.

What to do now

Update Node.js and affected Brotli packages using the fix for each deployed branch or your distributor's backport. Move unsupported Node.js releases to a supported version.
Update affected .NET runtimes and packages. Rebuild and redeploy self-contained and NativeAOT applications, then restart running apps.
Review request decoding and outbound HTTP clients. Where a fix is unavailable, stop decoding untrusted Brotli data until patched. A rule blocking compressed requests does not cover malicious responses.

What this means for your website

Website code can encounter Brotli through dependencies and outbound requests as well as incoming traffic. Check the decoder actually shipped in each container or application; updating the host library alone may leave bundled copies exposed.

Sources and updates

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →