Brotli decoder out-of-bounds write enables code execution; patch stops it
The claim
The authors assert that the out-of-bounds write in the Brotli decoder can be exploited to achieve remote code execution and that patching is the only complete mitigation.
Published as: “Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder”
So what
Organizations must patch all runtimes embedding Brotli and monitor for abnormal decoder behavior to prevent remote code execution.
The five-minute version
The write-up reproduces CVE-2026-111497 in the Node.js Brotli decoder and shows that a crafted Brotli stream can corrupt decoder state, leading to crashes, memory reads, and ultimately remote code execution. Exploits have been demonstrated in the lab and confirmed in the wild, affecting many runtimes that embed the upstream Google Brotli library. The Node.js patch changes the block-switch helper to return a proper error code, causing the decoder to reject malicious streams before any out-of-bounds write occurs. Detection relies on behavioral signals such as decoder error messages, SIGSEGV crashes, and sustained CPU usage.
What they found 2
- The exploit can cause a deterministic crash by writing to an unmapped page.
“In our lab, we aimed it at an unmapped page and produced a deterministic crash.”
- Vulnerable builds return a generic Z_BUF_ERROR while patched builds return a specific format error.
“On a vulnerable build, Node.js returns Z_BUF_ERROR with the message "unexpected end of file".”
What undercuts it the paper’s own results
- No single detection signal is conclusive; detection rests on noisy behavioral indicators.
Stated limits 3
- process.versions.brotli still reports 1.2.0 after the patch, making version checks unreliable.
- Mitigations such as rejecting Content-Encoding: br can break legitimate functionality and do not protect the outbound path.
- The upstream fix was committed months earlier but not released, and the patch shipped without a regression test or changelog entry.
What’s new here 4
- Identifies that the vulnerability spans multiple runtimes (Python, Bun, .NET, Java, Envoy, Istio) due to a shared Brotli C library.
- Provides a lab-verified exploit (Node2Shell) that can achieve code execution on unpatched Node.js images.
- Describes the precise patch change: returning a real error code to stop processing malformed streams.
- Offers concrete detection guidance using decoder error signals, process crashes, and CPU spikes.
Artifacts & methods 3
- Node2Shell exploitprimitive
- Google Brotli C librarysystem
- Imperva proof of conceptprimitive