I’M UNDER A CYBER ATTACK

Alert

Alert 2026-124 Critical Node.js Vulnerability (Node2Shell)

Affected product(s):

ProductAffected versions
Node.js22.x earlier than 22.23.4,
24.x earlier than 24.22.1, and
26.x earlier than 26.12.1
Google BrotliFrom 1.0.3 through 1.2.0
BunEarlier than 1.4.4
Brotli (PyPI package)1.2.0 and earlier
brotlicffi (PyPI package)1.2.0.2 and earlier

Unsupported Node.js branches (EoL) are also considered affected.

Description

An out-of-bounds write vulnerability has been disclosed in Node.js, known as Node2Shell and identified as CVE-2026-111497 (CVSSv4 9.2 – CRITICAL). An unauthenticated remote attacker can send specially crafted Brotli-compressed data and corrupt process memory, potentially causing a denial of service, memory disclosure, or remote code execution. The flaw can be reached through fetch(), request bodies processed by Express 5 with body-parser 2.x, and node:zlib. It is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1.

The source of the vulnerability lies in the Google Brotli decoder (c/dec/decode.c), which Node.js includes in its source code. When a compressed stream requests an invalid block switch, the DecodeBlockTypeAndLength() function returns a value that the fast decoding path does not check (CWE-252, unchecked return value). The decoder continues processing with a corrupted internal state and writes outside the bounds of its buffer (CWE-787, out-of-bounds write). Brotli versions from 1.0.3 through 1.2.0 are affected and are fixed in 1.0.10, 1.1.1, and 1.2.1, released on 21/10/2026.

Because the vulnerable code is in the Brotli library, it also affects Bun, fixed in version 1.4.4, and the Python Brotli and brotlicffi packages from PyPI, fixed in 1.2.1 and 1.2.1.0. The Python packages were updated without mentioning the vulnerability in their release notes, so dependency scanners may not flag them as vulnerable. The vulnerability was disclosed by Imperva. As of the date of this advisory, no active exploitation has been reported.

Mitigation

If an immediate update is not possible, OpenSourceMalware indicates two temporary alternatives until the update is applied in Python environments:

  • Uninstall the Brotli and brotlicffi packages. Without them, HTTP clients such as urllib3 (and therefore requests), httpx, aiohttp, and Scrapy switch to using gzip/deflate.
  • Remove br from the Accept-Encoding header in outgoing requests and reject Content-Encoding: br in incoming requests.

Solution

The solution is to update Node.js, Bun, and the Python packages to the fixed versions, and to update Brotli in any software that includes the library.

ProductFixed version
Node.js 22.x22.23.4
Node.js 24.x24.22.1
Node.js 26.x26.12.1
Google Brotli1.0.10, 1.1.1, or 1.2.1
Bun1.4.4 or later
Brotli (PyPI package)1.2.1
brotlicffi (PyPI package)1.2.1.0

In Python environments:

pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0"

It is recommended to manually review transitive dependencies, as scanners may not flag these packages, and to rebuild containers and images that include vulnerable versions. Services that decompress Brotli content from untrusted sources should be prioritized.

Node.js versions:

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Google Brotli versions:

https://github.com/google/brotli/releases

Bun 1.4.4:

https://bun.com/blog/bun-v1.4.4

Additional information: