CVE-2026-111497: Out-of-Bounds Heap Write and Remote Code Execution in Google Brotli Decoder (Node2Shell)

Vulnerability ID: CVE-2026-111497
CVSS Score: 9.8
Published: 2026-10-22

CVE-2026-111497, tracked in threat intelligence under the aliases Node2Shell, Broccoli2Shell, and HTTP2Shell, is a critical out-of-bounds heap write and denial-of-service vulnerability in the reference Google Brotli decompression library (c/dec/decode.c). The flaw originates from an unchecked return value and error-code conflation in DecodeBlockTypeAndLength() when processing malformed streams with single-block-type declarations (max_block_type <= 1). On the fast decoding path, the ignored error return causes the 32-bit unsigned block_length counter to underflow from 0 to UINT32_MAX (0xFFFFFFFF), corrupting internal decoder tables and enabling arbitrary heap memory overwrites via memmove16(). On the streaming path, the error return is misinterpreted as an incomplete bit-stream, trapping the worker process in an infinite 100% CPU loop. Because Google Brotli is embedded across major runtimes and infrastructure components—including Node.js, Envoy Proxy, Microsoft .NET, Istio, and Python—the vulnerability exposes a broad attack surface via standard HTTP Content-Encoding: br request and response bodies.

TL;DR

An unchecked return value in Google Brotli's DecodeBlockTypeAndLength() function leads to an integer underflow of block_length to 0xFFFFFFFF during fast-path decompression, enabling unauthenticated remote code execution via out-of-bounds heap writes or an infinite CPU loop during streaming decompression.

⚠️ Exploit Status: ACTIVE

Technical Details

• Vulnerability Class: CWE-252 (Unchecked Return Value) -> CWE-190 (Integer Underflow) -> CWE-787 (Out-of-Bounds Heap Write)
• Affected Component: Google Brotli Decoder (c/dec/decode.c: DecodeBlockTypeAndLength & ProcessCommandsInternal)
• Attack Vector: Network (Unauthenticated HTTP requests or responses with 'Content-Encoding: br')
• CVSS v3.1 / v4.0: 9.8 CRITICAL (v3.1) / 9.2 CRITICAL (v4.0)
• EPSS Score: 87.99% (99.76th Percentile)
• Security Impact: Remote Code Execution (fast path OOB heap write) or 100% CPU Infinite Loop DoS (safe streaming path)
• Exploit & KEV Status: Actively Exploited in the Wild; Listed in CISA KEV (Added 2026-10-27)

Affected Systems

• Google Brotli (libbrotli)
• Node.js Runtime (Express, Koa, NestJS, Next.js, undici, axios, node-fetch, got, superagent)
• Microsoft .NET Runtime & SDK
• Envoy Proxy
• Istio Service Mesh
• Bun Runtime
• Python brotli / brotlicffi
• Go andybalholm/brotli
• Apache Arrow, ClickHouse, DuckDB
• Tianocore EDK2, p7zip / 7-zip-zstd
• Debian 12, Ubuntu, Alpine Linux
• Brotli: >= 1.0.3, < 1.0.10 (Fixed in: 1.0.10)
• Brotli: >= 1.1.0, < 1.1.1 (Fixed in: 1.1.1)
• Brotli: >= 1.2.0, < 1.2.1 (Fixed in: 1.2.1)
• Node.js 22.x: < 22.23.4 (Fixed in: 22.23.4)
• Node.js 24.x: >= 23.0.0, < 24.22.1 (Fixed in: 24.22.1)
• Node.js 26.x: >= 25.0.0, < 26.12.1 (Fixed in: 26.12.1)
• .NET: < 8.0.33, < 9.0.22, < 10.0.14 (Fixed in: 8.0.33 / 9.0.22 / 10.0.14)
• Envoy Proxy: < 1.37.8, 1.38.0 - 1.38.5, 1.39.0 - 1.39.2 (Fixed in: 1.37.8 / 1.38.6 / 1.39.3)
• Istio: < 1.29.9, 1.30.0 - 1.30.5, 1.31.0 - 1.31.1 (Fixed in: 1.29.9 / 1.30.6 / 1.31.2)
• Bun: < 1.4.4 (Fixed in: 1.4.4)
• Next.js: < 16.4.3 (Fixed in: 16.4.3)

Code Analysis

Commit: 0ed4268

Detect and report invalid stream earlier.

diff --git a/c/dec/decode.c b/c/dec/decode.c
index e87e7f5ea..19c7e0283 100644
--- a/c/dec/decode.c
+++ b/c/dec/decode.c
@@ -1176,7 +1176,7 @@ static BrotliDecoderErrorCode DecodeContextMap(brotli_reg_t context_map_size,

 /* Decodes a command or literal and updates block type ring-buffer.
    Reads 3..54 bits. */
-static BROTLI_INLINE BROTLI_BOOL DecodeBlockTypeAndLength(
+static BROTLI_INLINE BrotliDecoderErrorCode DecodeBlockTypeAndLength(
     int safe, BrotliDecoderState* s, int tree_type) {
   brotli_reg_t max_block_type = s->num_block_types[tree_type];
   const HuffmanCode* type_tree = &s->block_type_trees[
@@ -1187,7 +1187,7 @@ static BROTLI_INLINE BROTLI_BOOL DecodeBlockTypeAndLength(
   brotli_reg_t* ringbuffer = &s->block_type_rb[tree_type * 2];
   brotli_reg_t block_type;
   if (max_block_type <= 1) {
-    return BROTLI_FALSE;
+    return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH;
   }

Exploit Details

• GitHub: Proof-of-concept bitstream generator and RCE exploit harness for CVE-2026-111497 by Dimas Maulana.
• GitHub: Node2Shell proof-of-concept repository demonstrating CVE-2026-111497 exploitation against Node.js.
• GitHub: Technical analysis and crash reproduction repository by Qi Deng.
• GitHub: Assetnote vulnerability scanner for identifying endpoints vulnerable to Node2Shell (CVE-2026-111497).

Mitigation Strategies

• Upgrade Google Brotli and all downstream runtimes (Node.js, .NET, Envoy, Istio, Bun, Python) that statically link or bundle the C decoder.
• Block or strip incoming HTTP requests containing the 'Content-Encoding: br' header at the WAF, API gateway, or reverse proxy layer.
• Configure outbound HTTP clients (undici, axios, node-fetch, got) to omit 'br' from 'Accept-Encoding' headers when querying untrusted external servers.
• Audit container images and host filesystems for secondary or statically compiled Node.js, Envoy, and .NET binaries.

Remediation Steps:

1. Identify all vulnerable Node.js instances by running: node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'VULNERABLE'"
2. Upgrade Node.js runtimes to versions 22.23.4, 24.22.1, or 26.12.1 (migrate off EOL Node.js 20.x).
3. Upgrade Google Brotli system libraries (libbrotli1) to versions 1.0.10, 1.1.1, or 1.2.1 and restart dependent services.
4. Upgrade Microsoft .NET runtimes to 8.0.33, 9.0.22, or 10.0.14.
5. Upgrade Envoy Proxy (< 1.37.8, 1.38.0-1.38.5, 1.39.0-1.39.2) and Istio (< 1.29.9, 1.30.0-1.30.5, 1.31.0-1.31.1) to patched releases.
6. Deploy WAF rules to drop HTTP POST/PUT/PATCH requests with 'Content-Encoding: br' until all upstream workers are patched.

References

• National Vulnerability Database (NVD) Record: CVE-2026-111497
• CVE.org Authoritative Record: CVE-2026-111497
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• Google Brotli Upstream Fix Commit (0ed4268a4401abcb4472096340477cf4af7d1a2b)
• Node.js Security Advisory (October 2026)
• GitHub Advisory Database (GHSA-9v8h-qqgm-4m35)
• Envoy Proxy Security Advisory (GHSA-3wvj-j6qm-62mr)
• Microsoft .NET Announcement Issue #494
• ELLIO Threat Research Analysis: Node2Shell RCE on Stock Node.js Builds
• Aikido Security Analysis: Node2Shell Node.js Brotli RCE
• Dimas Maulana (dimasma0305) CVE-2026-111497 PoC Repository
• Qi Deng (ikow) brotli2crash Analysis Repository
• Openwall oss-security Mailing List Disclosure
• RFC 7932: Brotli Compressed Data Format Specification

Read the full report for CVE-2026-111497 on our website for more details including interactive diagrams and full exploit analysis.