CVE-2026-111497 Node.js fixes for exploited Brotli

The Brotli flaw behind node2shell is being exploited in the wild and has been in CISA's Known Exploited Vulnerabilities catalog since October 27. CVE-2026-111497 is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, and Bun 1.4.4; earlier releases on those lines are affected. Check with node --version. Until patched, rejecting Brotli request bodies reduces that entry path, but it does not protect fetched responses.

For a production service, the real question is whether attacker-controlled compressed data reaches the decoder. Cycode's node2shell analysis describes an out-of-bounds write that can crash a process, expose memory, or execute code. Request-body middleware and HTTP clients can provide that path without your application code ever calling Brotli directly.

Verify what's actually running

Run this command in the environment that supplies the service's Node.js runtime.

node --version

Compare the result with the fixed release for CVE-2026-111497 for that major line: 22.23.4, 24.22.1 or 26.12.1. Node.js 20.x and other end-of-life lines have no patch for releases that bundle Brotli; those deployments need a supported line.

Check the deployed container or server first. Cycode distinguishes Dockerfile declarations from built images because an image can still contain an old runtime. Its inventory guidance also includes build hosts and digest-pinned images whose runtime version cannot be determined from the tag.

How the decoder reaches an invalid state

The defect behind CVE-2026-111497 starts with a malformed stream, not an npm dependency resolution problem. A stream can declare a single block type and then switch blocks. The vulnerable decoder fails to reject that transition, continues with invalid state, and writes beyond a buffer.

Khai Tran and Sylvie Mayer of OpenAI Codex Security found the issue and reported it to Node.js. The affected C library comes from Google and is bundled by Node.js and Bun; other runtimes and bindings also use it.

The National Vulnerability Database rates the flaw 9.8 Critical under CVSS 3.1. Google assigns 9.2 Critical under CVSS 4.0, while Node.js rates it High. Those are separate assessments, not interchangeable scores.

Cycode's timeline separates the original repository fix from the later runtime releases and disclosure.

The exploitation status has changed since Cycode's original account. That article reported no known exploitation in the wild as of October 23. The newer structured data records CISA catalog inclusion on October 27. The older no-exploitation statement is no longer the current status.

CVE-2026-111497 fixes by runtime

Identify which component supplies your decoder. This consolidated list preserves the fixed releases from Cycode's runtime, Python, and Microsoft tables.

For the underlying Google library, the affected ranges for CVE-2026-111497 are 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. Distribution packages require a separate check because vendors may backport the correction without adopting those upstream version numbers.

Find and patch Node.js services decoding untrusted Brotli

I'd prioritise services with both a runtime vulnerable to CVE-2026-111497 and an identifiable untrusted-input path. Cycode identifies Express 5 and body-parser 2 request handling as paths used in public code-execution research.

1. Inventory Node.js and Bun across servers, container base images, and build hosts. Include digest-pinned images for review rather than assuming an unreadable tag is safe.

2. Trace request-body decoding. In Express 5 and body-parser 2.x, json(), urlencoded(), text() and raw() support Brotli bodies. Check koa-bodyparser, @koa/bodyparser, koa-body and co-body, plus @fastify/compress when request decompression is enabled.

3. Trace response and direct decoding separately. Built-in fetch() decompresses Brotli responses, so fetching user-supplied URLs is relevant. Review uses of node:zlib, particularly zlib.brotliDecompress, brotliDecompressSync and createBrotliDecompress, including libraries that call them.

4. Upgrade the runtime and rebuild the deployable artifacts. Replace end-of-life Node.js lines, rebuild container images, and include standalone binaries compiled with Bun. Updating the build environment alone is not the same action as replacing the deployed artifact.

Cycode's request-body query requires a vulnerable image and a relevant dependency in the same directory. That can identify patch candidates, but it does not prove outside reachability and does not cover direct decoder calls or user-controlled fetch destinations. Use those results as a priority list, not a complete exposure verdict.

Check .NET opt-ins and rebuild self-contained apps

Microsoft released out-of-band updates on October 25. Unlike the Node.js middleware paths above, Brotli decompression is off by default in .NET and ASP.NET Core. Exposure to CVE-2026-111497 depends on the application or a dependency enabling it.

Search application code and dependencies for these settings and decoder APIs:

• ASP.NET Core request decompression using AddRequestDecompression and UseRequestDecompression.
• HttpClient response decompression with AutomaticDecompression set to Brotli or All.
• BrotliStream with CompressionMode.Decompress, or BrotliDecoder.

Update the runtime and the applicable SDK band from the table, then restart applications. Self-contained applications must be rebuilt and republished because they carry a runtime that a host update does not replace. Containers also need rebuilding: a previously built image using a floating tag such as aspnet:8.0 retains its old runtime.

Track host updates, self-contained applications, and container rebuilds as separate completion checks. A vulnerable .NET image is a reason to inspect the opt-ins, not proof that the application enables decompression.

Check distribution advisories for backported fixes

A package with an older-looking upstream version can already contain the correction for CVE-2026-111497. The October 29 tracker snapshot gives concrete examples:

• Ubuntu noble fixes brotli in 1.1.0-2ubuntu0.1; jammy fixes it in 1.0.9-2ubuntu0.1; resolute fixes it in 1.2.0-3ubuntu0.1.
• Debian bookworm fixes brotli in 1.0.9-2+deb12u1, trixie in 1.1.0-2+deb13u1 and sid in 1.2.0-4.1. Forky remains listed as vulnerable in that snapshot.
• Red Hat records fixed advisories for Red Hat Enterprise Linux 10, 10.0 Extended Update Support and 7 Extended Lifecycle Support.

Keep the runtime and system-library assessments separate. Ubuntu marks its nodejs entries for the listed releases as not affected, while Debian marks bookworm and trixie nodejs as vulnerable. A fixed distribution brotli package does not by itself settle the status of every bundled decoder.

Other consumers need the same ownership check. Python clients such as urllib3, httpx and aiohttp decode Brotli responses when brotli or brotlicffi is installed. Envoy and Istio exposure depends on enabling the Brotli decompressor. Go's cbrotli binding uses the system library, so its remediation depends on patched libbrotli.

Request filtering leaves fetch() responses uncovered

Cycode recommends a temporary request-side restriction while rebuilt services are being deployed: reject Content-Encoding: br at the proxy or load balancer. Match br case-insensitively and inside encoding lists such as gzip, br.

Turning off body-parser inflation is another request-side option, but it rejects every compressed body, including gzip. Neither measure protects Brotli responses consumed by fetch(). Node.js lists no workaround; these controls narrow specific paths rather than replace the runtime upgrade.

A bare Node.js HTTP server does not automatically decompress Brotli request bodies. Express 4 and body-parser 1.x do not decode those bodies either. Those details help distinguish request paths, but a service can still have a separate fetched-response or direct-decoder path.

Prioritise reachable decoders, then finish the rollout

CISA's current exploitation status makes the older absence-of-exploitation report a poor reason to delay. Start with exposed request decoders and user-controlled fetch destinations, apply temporary request restrictions where appropriate, and finish by replacing the deployed runtimes and artifacts. A dependency match helps find work; a rebuilt deployment is the remediation.