# Node2Shell (CVE-2026-111497): what business owners should ask their developers

A critical flaw in a compression library called Brotli affects Node.js and other software. Here is what it is, who should act, and the questions to put to whoever looks after your website or app.

- Page: https://www.cognivise.co.uk/blog/node2shell-brotli-vulnerability
- Topic: Running software
- Published: 2026-10-29
- Updated: 2026-10-29
- Author: Cognivise

## Key takeaways

- Node2Shell (CVE-2026-111497) is a critical flaw in the Brotli decoder used by Node.js and other software, with fixes released from 21 October 2026.
- Updating the system library is not enough: runtimes and apps often carry their own copy, and running programs must be restarted or redeployed.
- Ask your developers which runtimes you use, whether they are on a fixed version, and whether any are out of support.
- Reports differ on whether attacks have been seen, so treat the update as urgent either way.

Do you need to do anything about Node2Shell? If your website, app or API runs on Node.js, or on software that reads Brotli-compressed data, yes: ask whoever looks after it to confirm it has been updated. If you only use a hosted store and run no code of your own, patching is normally your platform provider's job, but anything custom you run yourself is still yours to check.

## What is Node2Shell?

Node2Shell is the nickname for CVE-2026-111497, a critical security flaw, scored 9.2 out of 10 on the CVSS scale (the standard severity score for vulnerabilities). It sits in Brotli, a compression library. Brotli shrinks web content so pages load faster, and servers, browsers and apps use it when data is marked `Content-Encoding: br`.

Researchers have also called the flaw HTTP2Shell and Broccoli2Shell, so searches for it return different names. It is the same issue.

In short, a specially built Brotli stream makes the decoder write past the end of a block of memory. Node.js says this can crash a program, expose memory or let an attacker run their own code. It is not limited to HTTP/2, despite one of the nicknames.

Node.js and Google released fixes on 21 October 2026, and public disclosure followed on 22 October.

## Is it being attacked?

Proof-of-concept exploit code is public. Reports differ on whether attacks have been seen in the real world: one security firm says it observed exploitation, while other write-ups said they had found none when they were published. Treat it as urgent either way, because attackers usually move quickly once working exploit code is public.

## Who is affected?

Any software that uses a vulnerable copy of the Brotli decoder (versions 1.0.3 to 1.0.9, 1.1.0 and 1.2.0). Security vendors list, among others:

- **Node.js**, in the 22, 24 and 26 lines, before the fixed releases below.
- **Python** HTTP libraries such as urllib3, requests, httpx and aiohttp, when a vulnerable Brotli package is installed.
- **.NET**, where Microsoft released emergency updates.
- **Bun**, plus Java stacks, curl, proxies such as Envoy and some Linux distributions, each with their own updates.

| Software | Fixed version |
| --- | --- |
| Node.js 22 / 24 / 26 | 22.23.4 / 24.22.1 / 26.12.1 |
| Brotli (the C library) | 1.0.10, 1.1.1 or 1.2.1 |
| Python Brotli / brotlicffi | 1.2.1 / 1.2.1.0 |
| Bun | 1.4.4 |

Check your own supplier's advisory for anything not listed here. Distributions and other products ship their own patched versions.

## How could an attacker reach it?

By getting your software to decompress data they control. That can happen in two ways:

- They send a compressed request straight to your server.
- Your software fetches a web address, or calls another service, and gets a malicious compressed response back.

Services that act as proxies, call outside APIs or accept compressed uploads have the most to check.

## Why is updating not as simple as it sounds?

- **Bundled copies.** Updating the Brotli library on your server does not fix Node.js or an app that carries its own copy. Each one has to be updated separately.
- **Running programs.** A long-running service keeps the old code in memory until it is restarted. Containers have to be rebuilt and redeployed.
- **Unsupported versions.** Node.js lines that are out of support, such as 18 and 20, have no upstream fix. The fix is to move to a supported line, which is a bigger job than a patch.

## What should you ask your developers?

1. **Which runtimes and libraries do we run, and at which versions?** Include the website, the admin tools, background jobs and any serverless functions.
2. **Which of them read Brotli data from outside?** Customer requests, uploads and responses from other services all count.
3. **Have they been updated to a fixed version and restarted?** "Installed" is not the same as "running".
4. **Does anything carry its own copy?** Containers, bundled apps and packaged tools often do.
5. **Is anything on a version that no longer receives fixes?** If so, ask for a plan and a date.
6. **How will we hear about the next one?** Someone should be named as responsible for watching security notices.

## What if you cannot patch today?

Interim steps reduce the risk but do not remove it. Security vendors suggest limiting or blocking inbound Brotli requests at your proxy or firewall, capping request sizes, and, for Python apps that can do without it, turning Brotli support off. None of these stops a malicious response coming back from a server your own software calls, so the update is still the real fix.

## What does this say about looking after software?

Security updates are not a one-off project. Libraries your software depends on change underneath it, and a flaw in one of them can affect many products at once. Someone has to be responsible for noticing and acting, with agreed response times. Our guides to [what application support and maintenance actually cover](https://www.cognivise.co.uk/blog/what-application-support-covers) and [what a fair maintenance contract includes](https://www.cognivise.co.uk/blog/software-maintenance-contract-guide) explain what to ask for.

If you are not sure what your software runs on, a [technical audit](https://www.cognivise.co.uk/blog/what-is-a-technical-audit) lists the runtimes and dependencies you have. If you want someone to keep them current, see our [ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership) service or [contact us](https://www.cognivise.co.uk/contact).

## Sources

This article is based on the vendor reports below, read on 29 October 2026. Versions and advisories may change, so check your own supplier's notice.

- [BleepingComputer: Critical HTTP2Shell Brotli vulnerability triggers emergency patches](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/)
- [Qualys: Node.js patches Brotli remote code execution flaw](https://blog.qualys.com/product-tech/2026/10/23/node-js-patches-brotli-remote-code-execution-flaw-find-vulnerable-runtimes-before-attackers-do)
- [Aikido: Node2Shell and the Python packages affected](https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497)

## Related

- [Ongoing support and ownership](https://www.cognivise.co.uk/services/ongoing-support-and-ownership)
- [What application support and maintenance actually cover](https://www.cognivise.co.uk/blog/what-application-support-covers)
- [Software maintenance contracts: what a fair one includes](https://www.cognivise.co.uk/blog/software-maintenance-contract-guide)