MDR
Solutions
Partners
About
Resources
Affected Environment
Any software that decompresses attacker-controlled Brotli data using Google Brotli 1.0.3 through 1.2.0. Patching Node.js fixes only the decoder copy that Node.js bundles. Bun, Python packages, Envoy, the Ruby gem, distribution libraries and compiled executables each need their own update.
Threat Overview
CVE-2026-111497 (also tracked as Node2Shell, HTTP2Shell and Broccoli2Shell) is a critical out-of-bounds write in the Brotli decoder. A crafted Brotli stream lets an unauthenticated remote attacker corrupt memory, with impact ranging from a process crash and memory disclosure to remote code execution.
Exposure Timeline
Report issued 27 October 2026. Fixes are available for Brotli, Node.js, Bun, Python, Envoy, Istio, Microsoft .NET (out-of-band release on 25 October 2026), Debian and Alpine. PAN-OS fixes are being released through 30 October 2026 and Red Hat errata are pending. Palo Alto Networks is not aware of malicious exploitation of this issue.
Attack Surface
Exposure requires the application to decompress attacker-controlled Brotli data. Paths include inbound request bodies sent with Content-Encoding: br (the most dangerous path, as any unauthenticated client can use it), responses automatically decoded by fetch, axios, got, SuperAgent and server-side frameworks such as Next.js, direct node:zlib Brotli calls on client data, Python libraries (requests, urllib3, httpx, aiohttp, Scrapy) and, in Microsoft .NET, ASP.NET Core request decompression, HttpClient automatic decompression and System.IO.Compression Brotli APIs (none enabled by default). A system that bundles the library but never passes untrusted data to the decoder has negligible exposure, though it should still be patched.
Technical Root Cause
The decoder's block-switch handling returns the same result for an invalid switch as for running out of input. The caller treats the invalid switch as a request for more input and keeps writing to an eight-byte internal buffer, so writes land outside it. The upstream fix returns a dedicated error so the decoder stops on an invalid stream.
Exploitation Pathway
An attacker supplies a crafted Brotli stream through any of the paths above. ELLIO research reported obtaining a shell on stock Node.js builds after about five attempts with ASLR enabled.
Operational Impact
A failed exploit attempt usually crashes the worker, so repeated attempts cause denial of service, and a service without a restart supervisor can stay down. Where core dumps are enabled, each crash can write session cookies, bearer tokens or key material to disk. Python Brotli and brotlicffi, the PHP streaming API and the Ruby gem can hang on the malicious stream without raising an error.
Strategic Impact
Risk is rated Critical for large and medium government entities and businesses, and High for small government entities and businesses.
Required Mitigation
Only an update fully remediates this issue. Prioritise internet-facing applications, APIs and reverse proxies, ideally within 24 hours. Key fixed versions:
If you cannot update immediately, reject Content-Encoding: br on inbound request bodies at the reverse proxy, WAF or load balancer where clients do not need it, block or allow-list destinations for server-side fetches, and avoid calling zlib Brotli functions on untrusted data. These steps reduce exposure to specific paths only. Do not disable ASLR as a mitigation.
Incident Response Guidance
Review web server and application logs for br-encoded POST requests from unauthenticated clients, especially very large bodies or short bursts of mixed-size bodies. Investigate unexpected crashes, memory errors, high CPU use and restarts, and look for Node.js or other application processes spawning shells or making unexpected outbound connections. Restrict access to core dumps and shorten retention. Verify patching using the Node.js release version or OS package version, because process.versions.brotli reports 1.2.0 on both patched and unpatched Node.js builds. Do not run circulating proof-of-concept code outside an isolated lab, as some public repositories may be malware aimed at defenders.
References
Node.js October 2026 security releases, Google Brotli v1.2.1 release, Palo Alto Networks advisory CVE-2026-111497, Microsoft .NET October 2026 out-of-band security updates, Red Hat RHSB-2026-015, ELLIO, Rapid7, Wiz, Sysdig and Aikido analyses. CVE-2026-111497.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)