Brotli CVE-2026-111497 (Node2Shell): Decoder Memory Corruption Response Guide

CISA lists the product as Google Brotli. Node.js 22.x, 24.x and 26.x are affected before the October 21 security releases; Node.js 20.x, 23.x and 25.x are also affected but are end-of-life and will not receive fixes. Tenable and Help Net Security name additional downstream consumers, including .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse. Whether a given application is exploitable depends on whether it decompresses Brotli data from untrusted sources, such as HTTP responses or uploaded files.

No CVSS base score was confirmed from the sources reviewed for this article, so none is stated here. Treat it as high priority on the strength of the KEV listing.

CISA added the CVE to KEV, which means exploitation evidence exists. Public proof-of-concept code is on GitHub, and ELLIO has reported in-the-wild exploit traffic. Reliability of code execution is contested: Imperva demonstrated remote code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts, while other researchers reported only crashes and limited memory exposure on standard builds. Plan for denial of service and memory disclosure as the realistic floor, and code execution as possible.

Start by finding every runtime and image that carries the Brotli decoder.

• •Run `node -v` on every host and container; flag anything below 22.23.4, 24.22.1 or 26.12.1, and any 20.x/23.x/25.x runtime
• •Inventory container images and bundled runtimes (Electron apps, serverless layers, base images) that embed Node.js or libbrotli
• •Check Python, .NET, Envoy/Istio and FFmpeg-based services for a Brotli build older than 1.2.1 (1.1.1 and 1.0.10 carry backports)
• •Prioritise internet-facing services that decompress Brotli request bodies or fetch remote content

Patching the library is the only complete fix; there is no configuration workaround in the sources reviewed.

• •Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1; move off end-of-life 20.x, 23.x and 25.x lines
• •Upgrade Brotli to 1.2.1 (or the 1.1.1 / 1.0.10 backports) where it is consumed as a standalone library
• •Update dependency lock files, rebuild container images, redeploy and restart services; a patched host does not fix an unrebuilt image
• •Verify that running workloads, not just build manifests, use the patched components
• •Check downstream vendor and distribution advisories for products that bundle Brotli; use the supplier's fixed version rather than the upstream string

No reliable indicators of compromise have been published; monitor for symptoms around the decoder.

• •Alert on unexpected Node.js process crashes or restarts, and on segfault messages in container logs, on services that accept compressed input
• •Review web and proxy logs for unusual `Content-Encoding: br` traffic to endpoints that do not normally receive it
• •Watch for unexpected child processes spawned by Node.js workers (MITRE ATT&CK T1059, T1190 for public-facing application exploitation)