Brotli Flaw (CVE-2026-111497, "Node2Shell"): What to Patch and How to Check

A critical out-of-bounds write in the Brotli decompression library affects Node.js, Bun, Envoy, and other software that decodes Brotli-compressed data. Here's what happened, who's affected, and how to check your stack.

Watch the 1-minute video explainer: https://youtu.be/hV2uATDq5C4

What happened

On October 21, 2026, Node.js shipped security releases for CVE-2026-111497, a high-severity flaw in the Brotli decoder bundled with Node's node:zlib module. The bug sits in Brotli's underlying C library (c/dec/decode.c), affecting Brotli versions 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1. Google is the CNA that assigned the CVE.

The root cause: an invalid block switch in a malformed Brotli stream gets reported as "need more input" instead of a permanent format error. The streaming decoder then keeps appending input bytes to an internal 8-byte buffer, writing past its end. An attacker who controls Brotli data that your application decompresses can corrupt decoder memory, potentially leading to a crash, memory disclosure, or remote code execution.

The upstream Brotli project fixed it in versions 1.0.10, 1.1.1, and 1.2.1. The captured release notes date only v1.2.1 to October 21, 2026. The CVE record gives a CVSS 4.0 score of 9.2 (Critical), citing CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value). NVD published its entry on October 22, 2026, with status "Awaiting Enrichment" and no NVD score. The Node.js advisory credits OpenAI Codex Security (Khai Tran and Sylvie Mayer) and lists mcollina and aduh95 as the fix authors.

Because Brotli is a widely-vendored C library, the fix had to roll out separately in every project that bundles its own copy: Node.js, Bun, Envoy, and (per third-party reporting, see below) others.

No source in this draft's research reports active, in-the-wild exploitation as of October 24, 2026. According to the captured press reporting, Imperva's Red Team demonstrated code execution on an unmodified Node.js 24.22.0 Linux ARM64 build, through a fetched HTTP response and an Express request body, but that reporting says the exploit took several tries, was not released, and was not tested on other builds.

Who is affected

• Node.js: versions 22.x, 24.x, and 26.x before the October 21 fixes. Fixed in v22.23.4, v24.22.1, v26.12.1. Node 20.x is end-of-life and received no fix in these releases; migrate to a supported, patched line.
• Bun: versions 1.0.21 through 1.4.3. Fixed in 1.4.4. Reachable via fetch() (Bun auto-decodes Content-Encoding: br by default), node:zlib Brotli functions, and DecompressionStream('brotli'). Compiled bun build --compile binaries stay vulnerable until rebuilt against the patched runtime.
• Envoy: v1.39.2, v1.38.5, v1.37.7, v1.36.11 are the affected versions listed in the captured advisory. Fixed in v1.40.0, v1.39.3, v1.38.6, v1.37.8, v1.36.12. Only deployments with the Brotli decompressor filter configured are impacted.
• Istio: confirmed by the Istio security bulletin. Impact is scoped to meshes that enable Brotli decompression, for example via an EnvoyFilter. Fixed in 1.31.2, 1.30.6, and 1.29.9 (1.29 reached end of life October 15, 2026).
• Reported by Aikido, as summarized in the captured press sources (attributed claim, not independently confirmed here): curl and Python HTTP clients (requests, httpx with the brotli extra, aiohttp, Scrapy) when the brotli or brotlicffi PyPI packages are installed. Aikido also states Apache's standard mod_brotli and Nginx do not decode Brotli by default, so they aren't exposed out of the box.
• Vercel: deployed WAF rules against the inbound vector and is rolling out patched runtimes; projects pinned to Node 20.x must move to 22.x/24.x and redeploy, since 20.x has no fix.

How to check

# Node.js: compare against fixed versions v22.23.4 / v24.22.1 / v26.12.1
node -v

# Bun: fixed in 1.4.4 (affected 1.0.21–1.4.3)
bun --version

# Envoy: fixed in v1.40.0 / v1.39.3 / v1.38.6 / v1.37.8 / v1.36.12
envoy --version
# and check your config for the Brotli decompressor filter:
grep -A2 "envoy.filters.http.decompressor" envoy.yaml | grep -i brotli

# Python: is a Brotli package even installed?
pip show brotli brotlicffi

# Go: list Brotli-related modules; separately inspect how each is linked
go list -m all | grep -i brotli

# System libbrotli package version (Debian/Ubuntu or RHEL/Fedora)
dpkg -l | grep libbrotli
rpm -q brotli

# Docker: check the Node base image tag your Dockerfile pins
grep -i "^FROM node" Dockerfile

What to update

• Node.js to v22.23.4, v24.22.1, or v26.12.1, matching your major line. This release also fixed nine other issues, including two high-severity TLS hostname verification bypasses, so it's worth applying in full rather than cherry-picking.
• Bun to 1.4.4 or later, and rebuild any bun build --compile binaries.
• Envoy to v1.40.0, v1.39.3, v1.38.6, v1.37.8, or v1.36.12.
• PyPI `brotli`/`brotlicffi`, Go cgo bindings, and curl: fixed version numbers for these were not confirmed from primary sources at the time of writing. Check the relevant vendor advisory directly for the package-specific fix, and verify which Brotli implementation and version your build uses. The confirmed upstream fixed versions are 1.0.10, 1.1.1, and 1.2.1. (Istio's fix is covered separately above: 1.31.2+, 1.30.6+, 1.29.9.)

Istio: what it is, how to check, how to patch

Istio is a service mesh: it wraps your workloads with Envoy proxies (the same Envoy covered above) running as sidecars inside meshed workload pods, plus Envoy-based gateways at the mesh edge. In ambient mode there's no per-pod sidecar; Layer 7 traffic goes through waypoint proxies, which are also Envoy-based (general Istio architecture, not something the bulletin spells out).

Exposure. The Istio security bulletin ISTIO-SECURITY-2026-007 scopes impact to meshes that enable Brotli decompression, for example through an EnvoyFilter that turns on the Brotli decompressor. An EnvoyFilter is just one example, so check for any Brotli decompression config rather than assuming you're clear.

How to check:

# Istio control plane version
istioctl version

# Proxy image tags running in the mesh (istio/proxyv2)
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep proxyv2

# Any EnvoyFilter enabling Brotli decompression
kubectl get envoyfilter -A -o yaml | grep -iE 'brotli|decompressor'

How to patch. Istio's fixed releases are 1.31.2+, 1.30.6+, and 1.29.9 (the 1.29 line reached end of life October 15, 2026). If you're on 1.29, patching to 1.29.9 only buys time; plan the move to 1.30 or newer. Prefer the newest patch release on your minor line: a later bulletin, ISTIO-SECURITY-2026-008 (Oct 21, 2026), lists those releases as affected by a separate issue, fixed in 1.31.3+, 1.30.7+ and an exceptional 1.29.10.

Patching the control plane alone isn't enough (general Istio behavior, not from the bulletin): existing sidecars keep running the old proxy binary until the pod restarts. After upgrading, restart your meshed workloads (for example kubectl rollout restart deployment -n YOUR_NAMESPACE, plus any StatefulSets or DaemonSets) so injection gives them the patched sidecar. For gateways, update the gateway deployment's proxy image or revision first, then restart it. Then re-run the image check above, and use istioctl proxy-status to confirm proxies are connected and in sync.

If you can't patch yet: remove the Brotli decompressor EnvoyFilter if it isn't actually required, which removes the Brotli decompression the bulletin scopes impact to. It's a stopgap, not a substitute for upgrading.

Mitigations if you cannot patch now

• Avoid decompressing Brotli data from untrusted sources. In Node and Bun, that means fetched HTTP responses from third parties and any request body your server auto-decodes.
• In Bun specifically, disable auto-decompression on outbound fetches you don't control: fetch(url, { decompress: false }).
• If you run Express 5 or body-parser 2, review whether Brotli-encoded uploads reach your app; per Aikido's reporting, this is a path plain Node HTTP servers don't expose by default.
• Disable the Brotli decompressor filter in Envoy/Istio if it isn't required.
• Per Aikido, advisory databases hadn't mapped this CVE to the affected PyPI packages at time of writing, so pip-audit, Dependabot, and Safety may not flag vulnerable installs yet. Don't rely on scanner silence as proof you're unaffected.

FAQ

Is this being actively exploited? No source reviewed for this article reports active, in-the-wild exploitation as of October 24, 2026. Treat it as a critical patch priority regardless, given the CVSS 9.2 rating and the breadth of affected software.

Does this affect plain Node.js servers that don't touch Brotli explicitly? Not by default, per the Vercel security bulletin: Node doesn't decode Brotli on its own. You're exposed when your app code or a dependency decompresses attacker-controlled Brotli data, such as a fetched third-party response or an upload your middleware auto-decodes.

I'm on Node 20.x. What do I do? Node 20 is end-of-life and received no fix. You need to upgrade to a supported, patched line (22.23.4+, 24.22.1+, or 26.12.1+).

Sources

• Node.js, "October 2026 Security Releases": https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• CVE Record, CVE-2026-111497: https://www.cve.org/CVERecord?id=CVE-2026-111497
• NVD, CVE-2026-111497: https://nvd.nist.gov/vuln/detail/cve-2026-111497
• google/brotli, release v1.2.1: https://github.com/google/brotli/releases/tag/v1.2.1
• Bun security advisory GHSA-663w-cv8g-jj2p: https://github.com/oven-sh/bun/security/advisories/GHSA-663w-cv8g-jj2p
• Envoy security advisory GHSA-3wvj-j6qm-62mr: https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr
• Vercel, "Node.js Security Advisory": https://vercel.com/kb/bulletin/node-js-security-advisory
• The Injection, "Brotli Node2Shell Decoder OOB Write": https://theinjection.dev/items/brotli-node2shell-decoder-oob-write/
• OSINTsights, "Brotli decoder flaw exposes multiple software to remote code execution": https://osintsights.com/brotli-decoder-flaw-exposes-multiple-software-to-remote-code-execution