Node2Shell: Node.js Brotli Remote Code Execution Vulnerability

CVE-2026-111497, nicknamed 'Node2Shell', is a high-severity vulnerability (CVSS 9.2) affecting Node.js and Bun runtimes that utilize the Brotli compression library. The flaw exists in how the Brotli decoder handles malformed streams, potentially leading to an out-of-bounds (OOB) write. If an attacker can force an application to decompress a malicious Brotli payload, they may be able to crash the process, leak memory, or achieve remote code execution (RCE).

The vulnerability is particularly critical for applications that automatically decompress untrusted input, such as web servers using Express 5 or body-parser 2.0+, and applications making outbound requests using fetch() to untrusted servers. While exploitation in the wild had not been reported as of October 2026, researchers have successfully demonstrated RCE against official Node.js Docker images in lab environments. Immediate patching of affected runtimes is required to mitigate the risk.