Node2Shell: Memory Corruption in the Node.js Brotli Decoder (CVE-2026-111497)
Description
Node2Shell is a memory-corruption flaw in the Brotli decompressor bundled with Node.js. When a server inflates a Brotli-compressed request body (for example an Express/body-parser, Koa or Next.js endpoint that accepts Content-Encoding: br), a specially crafted malformed stream drives the decoder down a path where an invalid block switch is mishandled, corrupting memory while the request is processed. An unauthenticated attacker can crash the Node.js process (denial of service) and, because the corruption is an out-of-bounds write, potentially achieve remote code execution. The affected runtime answers the malformed stream as a generic truncation error (Z_BUF_ERROR), whereas a patched runtime rejects it with the dedicated block-switch error code.
Remediation
Update Node.js to a release that bundles the fixed Brotli decoder (24.22.1 or later, and the corresponding patched 24.21.x / earlier maintenance lines). If an immediate update is not possible, reject or strip the Content-Encoding: br header on request bodies at the proxy, or disable Brotli request-body decompression in the application.