Node.js Brotli Vulnerability CVE-2026-111497: Fixed Versions and Risks

A flaw in the Brotli compression decoder can turn specially crafted compressed data into a route for memory corruption and potentially remote code execution in vulnerable Node.js applications. The vulnerability, tracked as CVE-2026-111497 and also called Node2Shell, prompted Node.js security releases on October 21, 2026, with the issue still relevant to administrators checking production deployments on October 24. The underlying problem sits in Google's Brotli library, which Node.js includes, rather than in application code written specifically for one website. Developers should update their runtime, but they also need to check standalone executables, containers and other software that may bundle an affected copy of the library. Sources: Node.js security advisory and Singapore's Cyber Security Agency.

What makes CVE-2026-111497 dangerous?

Brotli is a compression format used to reduce the size of web content transferred between servers and clients. A decoder reverses that process, turning compressed bytes back into their original data. The vulnerability occurs when the decoder handles an invalid transition between blocks in a specially crafted Brotli stream and fails to treat the input as a permanent format error. According to the Node.js security advisory, the streaming decoder can then keep appending data to a small internal buffer, writing beyond its intended boundary and corrupting process memory.

That distinction matters because a memory-corruption bug is not automatically the same as a successful remote attack. Depending on the environment and how the affected code is reached, the corruption could crash a process, expose sensitive memory or potentially allow an attacker to execute code. Remote code execution means making a target computer run instructions chosen by the attacker. The Node.js project identifies remote code execution as a potential impact, while the Cyber Security Agency of Singapore rates the vulnerability at 9.8 out of 10 under version 3.1 of the Common Vulnerability Scoring System. The practical risk depends on whether an application actually decompresses data that an attacker can control.

Which Node.js versions need an update?

The Node.js project released security updates on October 21, 2026, for its supported 22.x, 24.x and 26.x release lines. Administrators should compare the runtime actually deployed in production against the fixed versions below, rather than assuming that updating a package or application automatically updates Node.js. These are minimum fixed versions for the affected release lines, not a recommendation to remain on those exact patch releases indefinitely. Where a later supported security release is available, use that instead.

The last row deserves particular attention. A runtime that has reached end of life no longer receives the normal upstream security updates for that release line, so simply installing the latest available package from an old branch may leave the vulnerability unresolved. The Node.js project explicitly treats end-of-life versions as affected when a security release exposes a relevant issue. If an application cannot immediately run on a supported version, its owner should consult the operating-system or platform vendor for a verified backport and a documented migration plan. A workaround should not become an indefinite substitute for a maintained runtime.

Your application may be exposed even if you never call Brotli directly

Node.js applications often rely on built-in networking APIs or third-party libraries to handle web requests and compressed responses. The relevant interface includes the node:zlib module, which provides Brotli decompression functions such as brotliDecompress and createBrotliDecompress. An application may also receive compressed content through APIs that automatically decode HTTP responses. As a result, a developer who never explicitly wrote a Brotli decompression call may still need to investigate the libraries and data flows used by the application.

Consider a backend service that fetches information from a URL supplied by a customer. If the remote server returns a maliciously crafted Brotli-compressed response and the backend automatically decompresses it using a vulnerable runtime, the response can reach the affected decoder. That is a potential attack path, not proof that every application making outbound HTTP requests is exploitable. The decisive questions are whether the affected runtime is present, whether untrusted compressed input reaches the decoder and whether the application or its dependencies expose that functionality to an attacker. Services that only decompress trusted data may have a different exposure profile, but should still apply the security update.

The vulnerability extends beyond the Node.js executable

The deeper operational issue is that the flaw resides in a shared compression library. Updating one application does not necessarily update every other program that incorporates its own copy of the same decoder. The Python Package Index advisory database also identifies affected releases of Google's Python Brotli package, with version 1.2.1 containing the upstream fix. Bun, another JavaScript runtime, published its own advisory and recommends upgrading to Bun 1.4.4. These disclosures show why an inventory limited to Node.js server processes can miss vulnerable software elsewhere in the environment.

Teams should therefore inspect container images, compiled application binaries, serverless deployment packages and build tools that include a runtime or native library. A standalone executable may retain the vulnerable code even after the machine's globally installed runtime has been updated. The same problem applies to old container images that continue running after a corrected image has been built. Security teams should verify the actual version inside each deployed artifact and rebuild or redeploy it where necessary, rather than relying solely on the version installed on a developer's workstation.

How to check and remediate a deployment

Start by checking the Node.js version used by the running service, not merely the version installed in an administrator's interactive shell. Run node --version in the relevant environment, then compare the result with the fixed-version table. In containerized systems, inspect the runtime inside the image or container that actually serves traffic. If a process manager, hosting platform or deployment pipeline selects a separate runtime, confirm that version as well.

Next, update the affected runtime through the project's official distribution channel or your hosting provider's supported deployment process. Rebuild application artifacts and container images that bundle Node.js, then deploy the corrected versions. Restart or replace existing processes so they stop running the vulnerable code, and verify the effective version after deployment. Finally, review your software inventory for other packages that bundle Google's Brotli library, including the Python Brotli package and Bun-based executables, and apply their respective vendor fixes.

What administrators should verify after patching

A successful package installation is only the beginning of remediation. Confirm that every production instance is running a fixed release, including replicas that were not replaced during the initial deployment. Check image registries and deployment manifests for older tags that could be rolled back into service. Where an application has processed untrusted Brotli data while running a vulnerable version, review available logs and monitoring for unexplained crashes, unusual process behavior or other indicators of compromise. The published advisory establishes a serious vulnerability, but it does not by itself establish that a particular installation has been attacked.

Keep the vulnerability record tied to the actual software component and its version, rather than treating CVE-2026-111497 as a Node.js-only issue. That makes it easier to catch the same decoder embedded in different products and to verify fixes across teams. The next meaningful milestone is not simply that an update has been downloaded; it is that every exposed deployment has been replaced or mitigated, and that unsupported runtimes have a credible migration path. Until that inventory is complete, a patched primary server can coexist with a vulnerable worker, build tool or bundled executable elsewhere in the same environment.