Node2Shell: the Node.js Brotli flaw (CVE-2026-111497) and nine other CVEs fixed on October 21
> TL;DR: On October 21, 2026, Node.js released v22.23.4, v24.22.1 and v26.12.1, fixing ten CVEs. The worst, CVE-2026-111497 (nicknamed Node2Shell), is an out-of-bounds write in the bundled Brotli decoder. An application that decompresses attacker-controlled Brotli data can crash, leak memory or execute code. Node.js 20 and older will not get a fix.
The mechanism
According to the Node.js advisory, an invalid block switch was treated as a temporary need for more input instead of a format error. The decoder kept appending bytes to an eight-byte internal buffer. Google, which maintains Brotli, gives it a CVSS 4.0 score of 9.2 and released Brotli 1.0.10, 1.1.1 and 1.2.1. Any software bundling a vulnerable Brotli version is affected, beyond Node.js.
Who is exposed
A Node.js application is exposed only if it, or a library it uses, decompresses Brotli data coming from an attacker. Imperva tested two routes:
fetch() reading a Brotli-compressed response from a hostile server;raw() and json() parsers.Updating Express or body-parser does not help. The flaw lives in the runtime: only a fixed Node.js release resolves it.
Where exploitation stands
Imperva achieved code execution in the lab after several attempts. One public proof of concept reached code execution only on a deliberately weakened build. As of October 23, no in-the-wild exploitation is reported and the CVE is not in CISA's KEV catalog.
Other fixes not to miss
crypto.randomUUID() and randomInt() can repeat values in startup snapshots and single executable applications. Here you must rebuild the application, upgrading alone is not enough.What to do now
inflate: false option). This does not cover responses fetched with fetch().What this means for an AI agent
An agent with a "read a web page" tool does exactly what the first route describes: it calls fetch() on a URL it did not choose alone. A prompt injection can send it to a hostile server answering with a booby-trapped Brotli stream. The MCP server or agent backend running on Node.js then becomes the target.
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Palo Alto PAN-OS: CVE-2026-0322 exploited, no workaround, and three days for federal agencies
CISA adds CVE-2026-0322 to the KEV on October 14: code execution on the PAN-OS management interface, exploited in limited attacks. No known workaround, fixes per branch, federal deadline October 17.
FortiMail: a pre-auth RCE in the POP3 service (CVE-2026-44812) joins the CISA KEV
Heap buffer overflow in the FortiMail POP3 service: unauthenticated code execution, CVSS 8.8. CISA lists it in the KEV on October 2 (deadline October 30). Fixed in 7.6.6 and 8.0.4 — 9,412 instances remain exposed per Palo Alto Unit 42.
PHP2Shell: two unauthenticated RCEs in PHP (CVE-2026-109618 and 109619), and a third flaw with no patch
On October 21, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote code execution flaws, CVSS 9.2. mod_php is the most exposed. On October 23, CVE-2026-115560 arrived with no fix.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.