Node2Shell (CVE-2026-111497): Detecting & Mitigating the Node.js Brotli Decompression RCE

Overview: What is Node2Shell?

Tracked as CVE-2026-111497 and assigned a critical CVSS score of 9.2 to 9.8, Node2Shell (also known in security circles as *Broccoli2Shell* or *HTTP2Shell*) represents one of the most severe vulnerabilities disclosed in the JavaScript runtime ecosystem in recent years.

The flaw affects Google's open-source Brotli compression library (`c/dec/decode.c`), which is bundled natively into Node.js under the core `node:zlib` module. When an application decompresses an incoming Brotli stream, an attacker can trigger an Out-of-Bounds Write (Buffer Overflow) leading to process termination or unauthenticated Remote Code Execution (RCE) under the privileges of the Node.js process.

Root Cause Analysis in `c/dec/decode.c`

During Brotli decoding, the compressed stream can issue directives signaling a switch between internal block types. The vulnerability manifests through a structural misinterpretation:

1. 1When an invalid or malformed block switch is encountered within the compressed stream, the decoder logic in `c/dec/decode.c` incorrectly treats the condition as a temporary request for more input bytes rather than raising an immediate syntax error.
2. 2The streaming decoder continues reading and appending incoming payload bytes into an internal 8-byte buffer.
3. 3This continuous uncontrolled copy causes memory to overflow past the boundary of the internal chunk buffer (CWE-787: Out-of-Bounds Write), corrupting neighboring pointers and metadata on the heap.

Attack Vectors & Real-World Exposure

Any Node.js service that processes or decompresses untrusted input using Brotli is vulnerable:

• Express.js & Fastify Middleware: Applications utilizing `body-parser` or decompression middleware that automatically decompress request bodies with `Content-Encoding: br`.
• Backend Microservices & Crawlers: Services using Node's native `fetch()` or Axios to ingest third-party or untrusted web payloads without strict compression sanitization.
• API Gateways: Reverse proxies and ingress controllers written in Node.js performing request payload inspection.

Runtime Threat Detection with Sysdig & Falco

Because network-level packet inspection can be blinded by legitimate compression, runtime detection at the kernel/syscall boundary provides the highest-fidelity defense.

Threat researchers at Sysdig published actionable behavioral detection rules:

• Spawning Shells from Node Workers: Alert whenever `/bin/sh`, `/bin/bash`, or PowerShell is spawned as a child process of `node`.
• Unexpected Process Memory Inconsistencies: Monitor for sudden `SIGSEGV` or segmentation faults inside Node.js worker containers, which indicate failed brute-force exploitation attempts.
• Outbound Socket Establishment: Flag unexpected outbound TCP connections initiated by Node.js worker processes immediately following payload decompression.

Remediation Guidance

The Node.js project has pushed emergency security updates across all active LTS and current branches. Security leaders must mandate the following actions:

• Upgrade Node.js Environments: Upgrade to patched releases immediately: Node.js 22.23.4, Node.js 24.22.1, and Node.js 26.12.1.
• Container Base Image Rebuilds: Ensure Docker base images (`node:22-alpine`, `node:24-slim`) are pulled afresh and redeployed across Kubernetes clusters.
• CISA KEV Compliance: CVE-2026-111497 has been added to CISA's Known Exploited Vulnerabilities catalog; enterprise perimeter defenses should block malformed Brotli headers at the WAF tier while patching is underway.