CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attacker-controlled Brotli data. Successful exploitation may result in process crashes, disclosure of process memory, or remote code execution (RCE). Imperva reported demonstrating code execution in fresh containers running the official Node.js 24.22.0 Linux arm64 image, with multiple attempts required in its test environment. The vulnerable Brotli decoder may be present in a range of runtimes, libraries, and software packages, including Node.js, Bun, Python Brotli bindings, .NET, Envoy Proxy, Istio, Java brotli4j, libbrotli, curl/libcurl through Brotli dependencies, and Linux distribution packages. Applications may be exposed if they decompress attacker-controlled data using a vulnerable decoder. The vulnerability may be reachable through both inbound and outbound traffic paths. A malicious client could send a crafted request with Content-Encoding: br to a vulnerable server-side component that performs Brotli request decompression. Conversely, a malicious or compromised server could return a crafted Brotli-compressed response to a vulnerable client application that automatically decodes Brotli responses. ThreatLabz has observed reconnaissance and exploitation attempts targeting this vulnerability through Zscaler Deception, as detailed in the ThreatLabz Observations section below. RecommendationsZscaler recommends the following measures to address CVE-2026-111497 and monitor for potentially related activity:Patch vulnerable runtimes and libraries. Upgrade vulnerable runtimes, packages, and infrastructure components to the patched versions listed in the Vulnerable Versions table. Prioritize services that decompress untrusted Brotli data, including internet-facing applications that accept compressed request bodies and services that fetch content from external or user-controlled URLs. Validate each vulnerable component independently. Updating the system-wide libbrotli package may not remediate applications that statically bundle Brotli or ship their own decoder copy.Rebuild and redeploy containers. Use patched base images, runtimes, and libraries, and verify the versions in running workloads. Updating a host’s libraries does not update copies bundled within container images.Disable Brotli decoding where patching is delayed. If immediate patching is not possible, disable Brotli decompression on vulnerable paths where supported, following vendor guidance and testing for application compatibility.Monitor for exploitation and post-exploitation behavior. Investigate the following: Unexpected process crashes in Node.js, Bun, Python, .NET, Envoy Proxy, or service mesh workloads.Repeated malformed Brotli payloads.Requests containing Content-Encoding: br to endpoints that normally do not receive compressed request bodies.Abnormal memory access violations or segmentation faults.Web server or application worker crashes after compressed request handling.Unexpected child processes spawned by web application runtimes.Unexpected outbound connections following crashes or the processing of malformed compressed input. Vulnerable VersionsThe following table lists vulnerable versions and corresponding fixes for selected software that incorporates the Brotli decoder. ProductVulnerable VersionsPatched VersionsGoogle Brotli1.0.3 < 1.0.10 (semver)1.0.10Google Brotli1.1.0 < 1.1.1 (semver)1.1.1Google Brotli1.2.0 < 1.2.1 (semver)1.2.1Node.js22.0.0 – 22.23.322.23.4Node.js24.0.0 – 24.22.024.22.1Node.js26.0.0 – 26.12.026.12.1Bun< 1.4.41.4.4.NET8.0.0 – 8.0.328.0.33.NET9.0.0 – 9.0.219.0.22.NET10.0.0 – 10.0.1310.0.14.NET11.0.0-preview.1 – 11.0.0-rc.211.0.0-rc.3.26522.148Python Brotli (PyPI)1.2.01.2.1Python brotlicffi (PyPI)1.2.0.0 – 1.2.0.21.2.1.0Envoy Proxy1.39.2, 1.38.5, 1.37.7, 1.36.111.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12Java brotli4j< 1.24.01.24.0libbrotli (Debian)1.1.0-21.1.0-2+deb13u1libbrotliVaries by distributionApply vendor security updatesTable 1: Software versions vulnerable to CVE-2026-111497 and the corresponding patched versions.  ThreatLabz ObservationsThreatLabz observed reconnaissance and exploitation attempts involving CVE-2026-111497 through Zscaler Deception. Within the first 24 hours following public disclosure, Zscaler Deception’s global decoy mesh observed activity from 20 source IP addresses targeting 12 customers across 402 events. Of these events, 40% involved reconnaissance and 60% involved exploitation attempts. The table below summarizes the unique payloads associated with reconnaissance and exploitation attempts targeting CVE-2026-111497 observed through Zscaler Deception.Payload DescriptionJA4

Read the original article:

CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE