Node2Shell (CVE-2026-111497): am I affected, and which versions fix it?
Quotable summary
Node2Shell (also called Broccoli2Shell or HTTP2Shell) is CVE-2026-111497, an out-of-bounds write in Google’s Brotli decompression library, versions 1.0.3 through 1.2.0. Brotli is bundled into Node.js and many servers and proxies. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026, which means it has evidence of active exploitation. Translation: if you run Node.js, run node --version and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later.
Am I affected?
Who’s affected
- Apps and servers that decompress Brotli data from untrusted sources, like compressed request bodies (for example, Express 5 with default JSON body parsing) or
fetch()responses withContent-Encoding: br(NY ITS advisory). - Home users: NY ITS rates home-user risk as not applicable. If you don’t run servers or developer tools, there’s nothing to do beyond normal updates.
How to check (60 seconds)
- Run
node --version. - You’re on a fixed release if it’s 22.23.4+, 24.22.1+ or 26.12.1+ (Node.js security release).
- On Node 20, 23 or 25? Those are end-of-life and get no fix (NY ITS). Move to a supported line.
- Check your container images and CI runners too, not just your laptop.
What to do
- Upgrade Node.js, Bun, Envoy/Istio, Python
brotli/brotlicffiand the other affected components in the table below, then restart or rebuild so the new code is actually running. - Can’t patch yet? Stop affected apps from processing Brotli content from untrusted sources until you can (Canadian Cyber Centre), for example by rejecting
Content-Encoding: bron request bodies at the proxy where you don’t need it (NY ITS). - Watch for unexpected crashes or odd process behavior (Cyber Centre).
Fixed versions (checked 29 Oct 2026)
| Product | Affected | Fixed | Source |
|---|---|---|---|
| Brotli | 1.0.3–1.0.9, 1.1.0, 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | Cyber Centre |
| Node.js | 22.x, 24.x, 26.x before the fixed releases; 20, 23, 25 are EOL with no fix | 22.23.4, 24.22.1, 26.12.1 | Node.js |
| Bun | 1.4.3 and earlier | 1.4.4 and later | NY ITS |
| Envoy (Brotli decompressor configured) | before the fixed releases | 1.40.0, 1.39.3, 1.38.6, 1.37.8 | NY ITS |
| Istio (Brotli decompressor configured) | before the fixed releases | 1.29.9, 1.30.6, 1.31.2 | NY ITS |
Python brotli / brotlicffi |
brotli 1.2.0 and earlier; brotlicffi 1.2.0.x and earlier | later releases | NY ITS |
| Java brotli4j | before 1.24.0 | 1.24.0 | NY ITS |
| .NET (apps that enable Brotli decompression) | yes; .NET Framework is not affected | see Microsoft | NY ITS |
Other software and Linux distribution packages that bundle or link a vulnerable Brotli library are affected too, so check your vendors’ advisories.
Is it being exploited?
- CISA added CVE-2026-111497 to KEV on 27 Oct 2026 “based on evidence of active exploitation” (CISA). Earlier advisories, like NY ITS on 26 Oct, had reported public proof-of-concept code but no in-the-wild exploitation.
- The KEV entry sets a federal due date of 10 Nov 2026 (CISA KEV catalog). That deadline binds US federal civilian agencies, but CISA urges every organization to prioritize KEV items.
- Severity ratings differ: Singapore’s CSA cites a CVSS 3.1 score of 9.8 (CSA Singapore); Node.js rates it High (Node.js). Our original Broccoli2Shell post covers the other scores.
FAQ
Is Node2Shell the same as Broccoli2Shell and HTTP2Shell? Yes. They’re all nicknames for the same bug, CVE-2026-111497 (NY ITS).
How do I know if my Node.js is vulnerable?
Run node --version and compare it with the table. 22.23.4, 24.22.1, 26.12.1 or later are fixed.
What if I’m on Node 20? No fix is coming for Node 20, 23 or 25. Upgrade to 22.23.4, 24.22.1, 26.12.1 or later.
Do I need to do anything at home? Generally no. Keep your devices and apps updated as usual.
Sources
- CISA: Adds Two Known Exploited Vulnerabilities to Catalog (27 Oct 2026)
- CISA KEV JSON feed entry for CVE-2026-111497 (
dateAdded2026-10-27,dueDate2026-11-10) - Node.js: Wednesday, October 21, 2026 Security Releases
- NY ITS Advisory 2026-120 (26 Oct 2026)
- Canadian Centre for Cyber Security AL26-027 (28 Oct 2026)
- CSA Singapore AL-2026-154 (23 Oct 2026)
- Prior post: Broccoli2Shell: a Brotli decoder bug puts Node.js, Bun, Envoy and Python on the patch list