Node2Shell: Node.js Brotli Decompression Remote Code Execution

Node2Shell (CVE-2026-111497) is a critical memory safety flaw in the Brotli decoder bundled with Node.js and Bun. The vulnerability involves an out-of-bounds write that can be triggered when an application decompresses malicious Brotli data. While initial reports indicated no widespread exploitation in the wild as of late October 2026, security researchers have successfully demonstrated remote code execution (RCE) on official Linux arm64 Node.js builds.

The attack chain typically involves sending a crafted payload to a server that automatically decompresses request bodies (such as Express 5 or body-parser 2.x) or compromising a server that provides compressed responses to a Node.js client using the `fetch()` API. Because the flaw resides in the native runtime decoder, application-level code changes are insufficient; a full runtime upgrade is required to mitigate the risk.

This vulnerability is particularly urgent for services that interact with untrusted external servers or accept compressed user uploads. Affected release lines including Node.js 22.x, 24.x, and 26.x have received security patches. However, end-of-life versions such as Node.js 20.x, 23.x, and 25.x will not be fixed, necessitating a migration to supported versions.