CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

Introduction

On October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attacker-controlled Brotli data. Successful exploitation may result in process crashes, disclosure of process memory, or remote code execution (RCE). Imperva reported demonstrating code execution in fresh containers running the official Node.js 24.22.0 Linux arm64 image, with multiple attempts required in its test environment. 

The vulnerable Brotli decoder may be present in a range of runtimes, libraries, and software packages, including Node.js, Bun, Python Brotli bindings, .NET, Envoy Proxy, Istio, Java brotli4j, libbrotli, curl/libcurl through Brotli dependencies, and Linux distribution packages. Applications may be exposed if they decompress attacker-controlled data using a vulnerable decoder. The vulnerability may be reachable through both inbound and outbound traffic paths. A malicious client could send a crafted request with Content-Encoding: br to a vulnerable server-side component that performs Brotli request decompression. Conversely, a malicious or compromised server could return a crafted Brotli-compressed response to a vulnerable client application that automatically decodes Brotli responses. 

ThreatLabz has observed reconnaissance and exploitation attempts targeting this vulnerability through Zscaler Deception, as detailed in the ThreatLabz Observations section below.

Recommendations

Zscaler recommends the following measures to address CVE-2026-111497 and monitor for potentially related activity:

• Patch vulnerable runtimes and libraries. Upgrade vulnerable runtimes, packages, and infrastructure components to the patched versions listed in the Vulnerable Versions table. Prioritize services that decompress untrusted Brotli data, including internet-facing applications that accept compressed request bodies and services that fetch content from external or user-controlled URLs. Validate each vulnerable component independently. Updating the system-wide libbrotli package may not remediate applications that statically bundle Brotli or ship their own decoder copy.
• Rebuild and redeploy containers. Use patched base images, runtimes, and libraries, and verify the versions in running workloads. Updating a host’s libraries does not update copies bundled within container images.
• Disable Brotli decoding where patching is delayed. If immediate patching is not possible, disable Brotli decompression on vulnerable paths where supported, following vendor guidance and testing for application compatibility.
• Monitor for exploitation and post-exploitation behavior. Investigate the following: 
  • Unexpected process crashes in Node.js, Bun, Python, .NET, Envoy Proxy, or service mesh workloads.
  • Repeated malformed Brotli payloads.
  • Requests containing Content-Encoding: br to endpoints that normally do not receive compressed request bodies.
  • Abnormal memory access violations or segmentation faults.
  • Web server or application worker crashes after compressed request handling.
  • Unexpected child processes spawned by web application runtimes.
  • Unexpected outbound connections following crashes or the processing of malformed compressed input.

Vulnerable Versions

The following table lists vulnerable versions and corresponding fixes for selected software that incorporates the Brotli decoder. 

Table 1: Software versions vulnerable to CVE-2026-111497 and the corresponding patched versions. 

ThreatLabz Observations

ThreatLabz observed reconnaissance and exploitation attempts involving CVE-2026-111497 through Zscaler Deception. Within the first 24 hours following public disclosure, Zscaler Deception’s global decoy mesh observed activity from 20 source IP addresses targeting 12 customers across 402 events. Of these events, 40% involved reconnaissance and 60% involved exploitation attempts. 

The table below summarizes the unique payloads associated with reconnaissance and exploitation attempts targeting CVE-2026-111497 observed through Zscaler Deception.

Table 2: Unique payloads observed during reconnaissance and exploitation attempts targeting CVE-2026-111497.

How It Works

Brotli is a lossless compression algorithm and data format developed by Google. It is used for HTTP compression to reduce the size of web content such as HTML, CSS, JavaScript, JSON, and API responses. Brotli-encoded HTTP content is identified by the Content-Encoding: br header.

Applications may use Brotli directly or through dependencies such as runtimes, frameworks, HTTP clients, and middleware. In some configurations, these components automatically decompress Brotli-encoded content without application code explicitly calling Brotli APIs.

Vulnerability details

The flaw occurs in Brotli’s block-decoding logic. When a stream changes block type, the decoder determines the next block type and length. In vulnerable versions, there is a macro (in the fast-path logic) that does not properly check the return value of the DecodeBlockTypeAndLength function, which can cause the decoder to continue processing an invalid state (e.g., when provided a maliciously crafted Brotli stream). This can lead to an out-of-bounds write and be used as a primitive for RCE. The upstream fix modifies the decoder so malformed block-switch conditions return a distinct error that is propagated to the caller, stopping further decoding of the malicious Brotli stream.

Attack chain

Exploitation of CVE-2026-111497 may follow either an inbound or outbound path, depending on where Brotli decompression occurs, as shown in the figure below. Inbound attempts use crafted Brotli-compressed HTTP request bodies while outbound attempts use crafted responses returned by an attacker-controlled or compromised server. These responses may be consumed through fetch(), webhook delivery, URL previews, crawlers or scrapers, and API integrations. In either path, exploitation requires attacker-controlled Brotli data to reach a vulnerable decoder, with compressed HTTP content marked by Content-Encoding: br. 

Figure 1: Potential inbound and outbound exploitation paths for CVE-2026-111497.

Conclusion

CVE-2026-111497 affects the Brotli decoder used by Node.js and other software. Exposure depends on whether an application passes attacker-controlled Brotli data to a vulnerable decoder. Organizations should identify vulnerable components and apply corresponding vendor updates, including updates for applications that bundle their own copy of Brotli.

Zscaler Deception has observed active reconnaissance and exploitation attempts involving this vulnerability. ThreatLabz will continue monitoring for related activity and provide updates as additional findings become available.

Zscaler Coverage

Zscaler Private Access (ZPA) App Protection

The following ZPA App Protection signature detects attempts to exploit CVE-2026-111497 in internal applications accessed through ZPA, including activity originating from compromised endpoints or insiders:

• App.Exploit.CVE-2026-111497

Zscaler Deception 

Organizations should deploy the following Zscaler Deception decoys to help detect reconnaissance and exploitation attempts:

• MLflow
• Metaflow
• Bento Frontend
• Ray Serve
• GitLab

How Zscaler Can Help

The following table shows the typical attack stages and the mitigations recommended by Zscaler.

Indicators Of Compromise (IOCs)