%20is%20an%20out-of-bounds&imtext2=write%20in%20the%20Brotli%20decoder%20bundled&imtext3=with%20Node.js%20that%20can%20lead%20to%20RCE.&imtext4=%20&font=50&Gravity=West)
Affected Akamai ExAR customers have already received a detailed mapping of vulnerable assets with actionable mitigation steps.
Key takeaways
On October 21, 2026, Node.js released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js.
The vulnerability, named Node2Shell, allows an attacker who can supply malformed Brotli-compressed data to corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution (RCE).
The CVE was assigned a CVSS score of 9.2 (critical). Node.js rates the vulnerability as high severity.
Applications are exposed when they decompress untrusted Brotli data, including responses received through the built-in fetch() API and request bodies parsed by Express 5.
Akamai telemetry shows that 61% of networks are running affected Node.js versions.
Node2Shell was disclosed shortly after PHP2Shell, which we detailed in a previous blog post.
In this blog post, we explain the Node2Shell vulnerability, list the affected Node.js versions, and provide mitigation guidance, including Akamai Guardicore Segmentation Insight queries to help identify vulnerable assets.
Vulnerability details
Node2Shell originates in the Brotli decoder that Node.js bundles to provide Brotli decompression through its node:zlib module. Brotli is a compression format used for, among other things, HTTP content encoding.
A Brotli stream can signal a switch between block types during decoding. When a stream signals a block switch that its own structure makes invalid, the vulnerable decoder reported the condition as a temporary need for more input instead of a permanent format error.
As a result, the streaming decoder kept appending input bytes to an eight-byte internal buffer and wrote past its end, as described in the .
An attacker who can supply Brotli data that an application decompresses can corrupt process memory, which can lead to a crash, disclosure of process memory, or RCE (Figure). The attack does not require authentication.
Applications do not need to call the Brotli API directly to be exposed. Attacker-controlled Brotli data can reach the decoder through:
- The node:zlib module, in applications that pass untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().
The node:zlib module, in applications that pass untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().
- The built-in fetch() API, which automatically decompresses Brotli-encoded responses. A malicious or compromised server can then target the client application.
The built-in fetch() API, which automatically decompresses Brotli-encoded responses. A malicious or compromised server can then target the client application.
- Express 5 and body-parser 2, whose json, raw, text, and urlencoded parsers decompress request bodies sent with Content-Encoding: br by default, because the `inflate` option defaults to `true`. Any client can send such a request.
Express 5 and body-parser 2, whose json, raw, text, and urlencoded parsers decompress request bodies sent with Content-Encoding: br by default, because the `inflate` option defaults to `true`. Any client can send such a request.
A bare Node.js HTTP server does not decode incoming Brotli bodies on its own; HTTP content decoding is left to the application, as shown in the Node.js zlib documentation.
The upstream fix makes the decoder return a dedicated format error (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) for the invalid block switch and pass it back to the caller. Malformed streams are now rejected instead of being treated as incomplete input.
Affected versions
Node2Shell affects the following Node.js release lines:
- 26.x versions before 26.12.1
26.x versions before 26.12.1
- 24.x versions before 24.22.1
24.x versions before 24.22.1
- 22.x versions before 22.23.4
22.x versions before 22.23.4
Discontinued release lines, including 25.x, 23.x, 20.x, and earlier, do not receive a fix. Node.js states that discontinued versions are always affected when a security release occurs.
Mitigation
Mitigation strategies include:
- Upgrade to a patched version
Upgrade to a patched version
- Segment to limit blast radius
Segment to limit blast radius
- Turn off compressed request bodies
Turn off compressed request bodies
- Identify vulnerable hosts with Akamai Guardicore Segmentation
Identify vulnerable hosts with Akamai Guardicore Segmentation
Upgrade to a patched version
Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1. The Node.js advisory does not offer a workaround, so upgrading is the only complete remediation.
Organizations running a discontinued release line should move to a supported release line.
Segment to limit blast radius
Use microsegmentation to restrict inbound access to Node.js services to sources that require it, and limit outbound connections from assets running vulnerable Node.js instances.
This reduces the attack surface and the impact of a compromised asset.
Turn off compressed request bodies
If your application does not need to accept compressed request bodies, set the body-parser inflate option to false. Compressed bodies are then rejected with an HTTP 415 error.
Identify vulnerable hosts with Akamai Guardicore Segmentation
The following Akamai Guardicore Segmentation Insight queries can be used to detect and segment vulnerable applications:
Linux assets
Windows assets
Bottom line
Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder bundled with Node.js that can lead to RCE in applications that decompress untrusted Brotli data.
Every supported Node.js release line was affected, and common paths such as fetch() and Express 5 expose applications that never call the Brotli API directly. Organizations should upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1 immediately.
Stay tuned
The Akamai Security Intelligence Group will continue to monitor, report on, and create mitigations for threats such as these for both our customers and the security community at large. To keep up with more breaking news from the Akamai Security Intelligence Group, check out our research home page and follow us on social media.
About the author
Akamai Security Intelligence Group
Akamai SIG is a global team of world-class researchers, engineers, strategists, and data scientists with a broad range of expertise and security disciplines. Our data sources include the enormous Akamai Cloud, open sources, collaboration with third parties, and dark web intelligence. We have also developed our own algorithms and tools that help us deliver our research and keep Akamai security solutions up to date.
