Node2Shell (CVE-2026-111497): patch Node.js and Python now

Node2Shell, tracked as CVE-2026-111497, is a flaw in the Brotli decompression code that Node.js, Python packages and .NET all use. Crafted compressed data can corrupt memory, crash the process and in some setups run code. On 27 October 2026 CISA put it on its list of exploited vulnerabilities. If you run a Node.js or Python backend, check it this week.

What Node2Shell is

Brotli is a compression format, used by browsers and servers next to gzip. The bug sits in Google’s Brotli decoder, versions 1.0.3 to 1.2.0, and is fixed in 1.0.10, 1.1.1 and 1.2.1. Google scores it 9.2 (Critical) under CVSS 4.0, according to SecurityWeek.

Node.js bundles that decoder and fixed it on 21 October. Its advisory says an attacker “who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution”. Node.js rates it High. The fixed versions are:

Release line	Fixed in
Node.js 22	22.23.4
Node.js 24	24.22.1
Node.js 26	26.12.1

Node.js 20 and 25 are end of life and get no fix, Sysdig notes. Microsoft patched .NET, Visual Studio and PowerShell, and Bun fixed it in 1.4.4.

Is it really exploited?

Yes, but the picture is mixed. Public proof-of-concept code appeared about a day after the patch. On 26 October, the security firm ELLIO saw exploit traffic aimed at the official Node.js 24.22.0 build, after earlier scans for servers that accept Brotli-compressed requests. When ELLIO replayed that attacker’s exploit, it got no shell in 50 attempts.

So reliable remote code execution is hard for now. A crash is easy, and a crash on a busy API is already an outage. CISA treats the flaw as exploited, and US federal agencies must patch by 10 November. Don’t wait for a better exploit to show up.

Which applications are exposed

The bug only matters when your code decompresses Brotli data that someone else controls. That happens more often than you’d think, because frameworks do it for you. Sysdig lists these paths in Node.js:

• Express 5 with express.json(): body-parser 2.x decompresses Brotli request bodies by default. Express 4 with body-parser 1.x rejects them.
• Server-side fetch(): it decompresses Brotli responses, so a call to a server you don’t control (a webhook target, a scraper, a URL a user typed) can deliver the payload. Sending Accept-Encoding: identity doesn’t prevent it.
• Koa, Strapi and Fastify with @fastify/compress.
• Any direct use of zlib.createBrotliDecompress().

Python has the same problem. The PyPI packages Brotli and brotlicffi are fixed in 1.2.1 and 1.2.1.0. According to Aikido, requests (through urllib3), httpx and aiohttp decode Brotli automatically once one of those packages is installed. Your own code doesn’t need to import it. That covers most scrapers, API clients and AI agents that fetch web pages.

Watch out for Linux distributions too. On Debian, Ubuntu, Alpine and similar systems, the Node.js package can use the system Brotli library. The Node.js version number then doesn’t tell you whether you’re patched. Update the brotli package of the operating system as well.

What to do now

1. Make a list. Find every Node.js runtime: servers, containers, CI runners, serverless functions and tools that ship their own Node.js. Run node --version on each.
2. Update Node.js to 22.23.4, 24.22.1, 26.12.1 or newer. Move anything on Node.js 20 or 25 to a supported line.
3. Rebuild your images. A pinned base image doesn’t pick up fixes. Pull the new base, rebuild, redeploy and restart the processes.
4. Update Python packages. Run pip show brotli brotlicffi in every environment and upgrade to 1.2.1 or 1.2.1.0. Check your lockfiles, because these often come in as an optional extra.
5. Update the OS library on hosts and images that use the distribution’s Brotli.
6. Block what you can’t patch today. CISA advises blocking Brotli-compressed requests at the proxy or firewall, or turning off Brotli decoding. In Express, express.json({ inflate: false }) does that, but it also rejects gzip. Neither protects outgoing fetch() calls.
7. Plan for 11 November. Node.js has announced its next security release for that day, with fixes rated High for 22.x, 24.x and 26.x. It doesn’t say what they fix. Keep your update pipeline ready, so the next patch is a routine job.

If an unpatched service crashed on strange requests in the past two weeks, treat it as a possible attack. Check the logs and rotate the secrets in that process’s environment, as we described for the LiteLLM supply chain attack.

How we approach this

Software that fetches pages from the open web gets Brotli from servers it doesn’t control. Our automatic news checks for every client do exactly that, and so do many custom web applications that call outside APIs. For services like these, we pin the runtime version in the image and rebuild from a fresh base, so that a fix like this one becomes a small, reviewed change instead of a search through servers.