CVE-2026-111497: Critical Node2Shell Flaw in Node.js Brotli Decoder

Summary

Node2Shell is a critical vulnerability (CVE-2026-111497) affecting the Brotli decoder bundled with Node.js and caused by an out-of-bounds write. Attackers can exploit the flaw by supplying malformed compressed streams to services that process Brotli data, potentially resulting in denial of service, memory disclosure, or remote code execution. The vulnerability poses particular risk to services using Express 5 or middleware that automatically performs Brotli decompression.

Investigation

The Sysdig Threat Research Team analyzed the vulnerability and reported that a public PoC emerged within hours of the patch release. Research by Imperva and Vercel demonstrated that code execution is possible on specific architectures, including Linux arm64. The investigation showed that exploitability depends on whether an application or its libraries, such as body-parser, process attacker-controlled Brotli streams.

Mitigation

The primary mitigation is upgrading Node.js to versions 22.23.4, 24.22.1, or 26.12.1, and updating Bun to version 1.4.4 or later. Organizations should also disable request decompression where practical, including setting inflate: false in body-parser. Deploying WAF rules to reject untrusted Content-Encoding: br requests and running services under unprivileged accounts provide additional layers of defense.

Response

If a potential exploitation chain is detected, such as a Node.js process crash followed by unexpected program execution, security teams should immediately isolate the affected workload. Monitor for post-exploitation activity, including interactive shells, unauthorized malware downloads, cryptomining, or theft of secrets and cloud tokens. Patching all reachable vulnerable services should remain the highest priority.

Simulation Execution

• Attack Narrative & Commands: The adversary targets a web application running Node.js. They send a malicious Brotli-compressed payload that triggers a memory corruption error, causing the node process to crash. Immediately following the crash, the attacker utilizes the hijacked execution flow to spawn a /bin/bash shell to establish persistence and begin local reconnaissance. This sequence of a node event followed by /bin/bash execution is designed to match the selection_crash and selection_suspicious_exec logic of the detection rule.

• Regression Test Script:

  #!/bin/bash
  # Simulation of Node2Shell-style exploitation pattern
  
  echo "[+] Starting Node2Shell simulation..."
  
  # 1. Simulate a Node.js process that 'crashes' or is terminated abruptly
  # In a real scenario, this is a crash. Here we simulate the telemetry 
  # of a node process being invoked/handled.
  node -e "process.exit(1)"
  echo "[+] Node.js process 'crashed' (Exit Code 1)."
  
  # 2. Simulate the immediate execution of a suspicious shell
  # This mimics the payload triggering the shell after the crash.
  /bin/bash -c "echo 'Exploitation Successful: Shell Spawned'"
  
  echo "[+] Simulation complete. Check SIEM for detection."

• Cleanup Commands:

  # No persistent files were created by this simulation.
  # Simply ensure no rogue bash processes are running.
  pkill -f "Exploitation Successful"