Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns

CISA has added the Node2Shell flaw, tracked as CVE-2026-111497, to its Known Exploited Vulnerabilities catalog. Attackers are already sending live exploit traffic at Node.js servers, so teams should patch right away.

CISA added the bug to its Known Exploited Vulnerabilities catalog on October 27, 2026. Federal agencies must fix it by November 10, 2026. CISA lists it as an unchecked return value flaw in Google Brotli. It says a remote attacker with no login can use a crafted Brotli stream to corrupt memory, leak data, crash the app, or possibly run code. CISA marks ransomware use as unknown. It also says forensic triage is not required under BOD 26-04.

The flaw goes by several names. Researchers call it Node2Shell, HTTP2Shell, Broccoli2Shell and Brotli2Shell. Google’s CNA gives it a 9.2 Critical score under CVSS 4.0. The bug is an out-of-bounds write in the Brotli decoder, and Wiz’s technical write-up covers detection and mitigation for cloud teams.

Our own earlier report on the Node2Shell proof of concept covered the first public code execution demo. Things have moved fast since then. Within days, the story went from a lab demo to real attacks.

Node2Shell Vulnerability

Brotli is a compression format that web servers and clients use to shrink traffic. A Brotli stream is split into blocks, and special switch commands tell the decoder which block type comes next. The trouble starts when a kind of block has only one type declared.

A switch in that case is invalid and the decoder should reject it. ELLIO’s research explains that the helper function returned a plain false for this case. It also returned false when the decoder simply ran out of input. Two different problems got the same answer.

When the caller hears that more input is needed, it sends more. The decoder keeps leftover bytes in an internal eight-byte buffer. A real shortage drains that buffer on the next chunk. An invalid switch never drains it. The bytes keep piling up, and past the eighth byte the writes land outside the buffer. Because the write uses a signed 32-bit offset, an attacker can pick a spot within roughly 2 GB and copy 16 bytes of their own data there.

The fix is upstream commit 0ed4268a. It makes the helper return a real error code, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH with value -17, so bad streams stop at once. The bug has been in Brotli since version 1.0.3 in March 2018. ELLIO says the fix sat in the public master branch from February 2026 with no release or advisory for about eight months.

Who Is Affected

Node.js 22.x, 24.x and 26.x are hit, and so are the end-of-life 20.x, 23.x and 25.x lines. The old lines will get no fix. Fixed Node.js versions are 22.23.4, 24.22.1, and 26.12.1. Google fixed Brotli in 1.0.10, 1.1.1, and 1.2.1.

A bare Node.js server does not unpack a Brotli body just because it arrives. Something has to pass the bytes to the decoder. ELLIO describes three common paths. The first is an inbound request with Content-Encoding set to br. Express 5 with express.json() or express.raw(), body-parser 2 and Koa with @koa/bodyparser all unpack it before any route code runs.

The second is an outbound fetch. Built-in fetch(), axios, got, and SuperAgent will decode a hostile server’s reply, so link previews, webhooks, and crawlers are all at risk. The third is any direct node:zlib call on client data.

The problem reaches well past Node.js. Bun before 1.4.4 is affected, and so are the Python packages Brotli and brotlicffi, which need 1.2.1 and 1.2.1.0. Envoy, the Ruby brotli gem, and many Linux distributions are also on the list. The CIS advisory says the flaw sits in Google Brotli versions 1.0.3 through 1.2.0 on all platforms. Tenable’s FAQ lists affected products in one place.

One trap is worth knowing. Node.js cherry-picked the fix without changing the bundled version string. So process.versions.brotli shows 1.2.0 on both patched and unpatched builds. Check the Node.js release number instead.

Imperva’s Red Team showed the first working exploit on October 22. They ran code on the official Node.js 24.22.0 Linux arm64 image, using both fetch() and Express 5 request bodies. Their write-up, Node2Shell: From Brotli Data to Remote Code Execution, says version 24.22.1 rejected the same input.

ELLIO then repeated the attack on x86-64. It got a shell on four targets running the same build. These were a plain node:http server, the official node:24.22.0-slim image running as root, Express 5.3.0, and Koa 3. Each shell ran as the service’s own account.

The lab found that official Node.js builds are non-PIE, so the binary loads at the same address every time. Address space layout randomization still shuffles the heap and stacks, so an attacker has to guess. With ASLR on, a shell appeared at around attempt 5. With ASLR off, 60 attempts gave no hit. Turning it off does not help.

Two target-specific values decide success. One is the number of the accepted socket, which the shell uses for input and output. The other is a memory offset tied to one exact Node.js build. The offset for 24.22.0 gave nothing against 22.23.3 or 26.12.0 in 10,000 tries. That limits attackers to waves aimed at one popular build at a time.

Scanning began first. A checker calling itself node2shell-check/1.0 hit ELLIO’s sensors from AS44620. It sent 20 Brotli bodies in two bursts to find hosts that decompress Brotli at all. None carried the real trigger. This looked like list building ahead of an attack.

Exploit traffic followed on October 26 at 15:08 UTC. ELLIO saw a single 23,069,983-byte request with SHA-256 7fcbdaaecd4419e2930927844f3b772668204737a4e7602a2290c991c93c5c4b. It came from 94.154.43.7, an address ELLIO rates as malicious with high confidence.

The address was first seen in December 2025 and was active on 47 of the last 90 days. It has been tied to PHP2Shell exploitation, Palo Alto GlobalProtect and FortiOS SSL VPN probing, and Kubernetes scanning. The request targets only Node.js v24.22.0 on x86-64.

The delivery layer copies public exploit code. The ROP chain, which takes over the process, is original. It plants /bin/sh in its own data and calls Node’s execvp from there. It does not use the string already inside Node, as both public chains do.

ELLIO tested it against a clean vulnerable target and got zero shells in 50 attempts. The chain crashed the process instead. ELLIO thinks this was a first try fired before the operator tested the last step. It warns that the operator looks focused on mass exploitation. Teams that remember React2Shell will see the same pattern of fast public code followed by quick scanning. Microsoft documented that earlier flaw in its React2Shell defense guide.

Failed attempts are not harmless. ELLIO saw that most of its 400 Express attempts crashed the worker instead of giving a shell. A crash can write a core dump, and that dump may hold session cookies, tokens and keys from other visitors.

On a stock Ubuntu host, systemd-coredump saves these files in /var/lib/systemd/coredump. Containers usually write nothing, so the harm there is only downtime. Some other decoders hang quietly instead. Python Brotli 1.2.0, brotlicffi 1.2.0.0, the PHP streaming API and the Ruby gem all return nothing and never finish, and the PHP case spins at 100% CPU.

Patch first. Move Node.js to 22.23.4, 24.22.1, or 26.12.1, and update Bun, Python packages, Envoy, and any distro Brotli library. Debian users should look for DLA-4855-1 or DSA-6582-1. Alpine users need brotli 1.2.1-r0, or 1.1.1-r0 on 3.21. Leave the old 20.x, 23.x and 25.x lines behind, since they will never be fixed.

A Node.js upgrade only fixes the copied Node bundles. Tools with their own copy, like bun build –compile executables, DuckDB, and PHP extensions, need separate updates. Rebuild images, refresh lockfiles, and restart processes.

A Dockerfile that pins 24.22.0 keeps shipping the bad build until someone edits that line. Check staging, CI, serverless, and developer laptops too.

Until patching is done, block inbound Content-Encoding: br where you can. Also watch logs for large Brotli POST bodies, repeated worker crashes, and the IP and hash above. Limit who can read core dumps, and shorten how long you keep them. Federal teams face the November 10 deadline, but every other team should treat that date as a ceiling and not a goal.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Node2Shell Vulnerability Actively Exploited in the Wild, CISA Warns appeared first on Cyber Security News.