Node.js Brotli Remote Code Execution (Nodel2Shell)

Byadmblake

What is the Vulnerability? CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web communications and is bundled with Node.js through its `zlib` module. The vulnerability occurs when the decoder processes specially crafted Brotli-compressed input. An…

What is the Vulnerability?

CVE-2026-111497 is an out-of-bounds write vulnerability in the Google Brotli decoder, a component used to decompress data encoded with the Brotli compression algorithm. Brotli is widely used in web communications and is bundled with Node.js through its `zlib` module.

The vulnerability occurs when the decoder processes specially crafted Brotli-compressed input. An attacker who can supply malicious compressed data to a vulnerable application may corrupt adjacent memory, potentially leading to information disclosure, denial of service, or remote code execution.

The root cause is an error in the decoder’s handling of malformed block-switch commands. Under certain conditions, the streaming decoder incorrectly treats an invalid block switch as a request for additional input rather than a format error. This can cause data to be written beyond the bounds of an internal eight-byte buffer, corrupting adjacent process memory.

The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0. Fixed versions include 1.0.10, 1.1.1, and 1.2.1, depending on the release branch. The Node.js project has also released patched versions for affected release lines.

On October 22, 2026, Imperva published research demonstrating remote code execution against a vulnerable Node.js build. Public proof-of-concept references are also listed in Red Hat’s vulnerability bulletin, increasing the risk to unpatched deployments.

What is the recommended Mitigation?

Organizations should prioritize updating vulnerable Node.js deployments and Brotli libraries to fixed versions. Because the vulnerability can lead to remote code execution, systems that process untrusted compressed content should receive particular attention.

Recommended actions:

1. Apply security updates: Upgrade Node.js to 22.23.4, 24.22.1, or 26.12.1, as appropriate, or a later fixed release. Update standalone Brotli packages to the applicable fixed version.

2. Review application exposure: Identify services that decompress untrusted Brotli data, including applications using node:zlib, HTTP clients processing compressed responses, and middleware that decompresses incoming request bodies.

3. Apply temporary restrictions where feasible: Until updates are deployed, limit untrusted Brotli-compressed traffic on affected application paths where operationally practical. Test any restrictions to avoid disrupting legitimate traffic.

4. Investigate suspicious activity: Review application and process logs for unexpected crashes or decompression errors. Correlate anomalies with incoming traffic and runtime versions; these symptoms alone do not confirm exploitation.

5. Rebuild and redeploy affected containers: Ensure production images and bundled dependencies include the patched runtime or library rather than relying solely on host-level updates.

What FortiGuard Coverage is available?

• FortiGuard Labs is monitoring CVE-2026-111497 and will update this Threat Signal as new threat intelligence and protection information become available. Organizations should prioritize patching affected Node.js deployments and Brotli libraries, particularly where applications process untrusted compressed data.

• FortiGuard Labs has available IPS signatures to detect and protect against attacks targeting CVE-2026-111497. https://www.fortiguard.com/encyclopedia/ips/62703

• FortiGuard Antivirus & Behavior Detection detects and blocks malicious files, web shells, and other payloads that may be delivered following successful exploitation.

• FortiGuard Web Filtering blocks access to known malicious domains, command-and-control infrastructure, and payload-hosting locations associated with post-exploitation activity.

• FortiGuard Indicators of Compromise (IOC) Service can help identify known indicators associated with compromise and malicious infrastructure.

• FortiEDR provides endpoint detection and response capabilities for suspicious post-exploitation activity on systems that may be affected following compromise.

• FortiGuard Incident Response – Supports investigation, containment, and recovery following suspected compromise of PLCs or OT infrastructure.

Related