Node.js shipped security releases on 21 October fixing 10 vulnerabilities, 4 of them high. The one being called Node2Shell is CVE-2026-111497, and Node's own advisory title does not hedge: "Node.js Brotli decoder out-of-bounds write permits remote code execution."

What the bug is

Node's description is unusually readable, so it is worth quoting rather than paraphrasing: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer."

An eight-byte buffer, and a decoder that kept filling it because it had been told the stream was merely incomplete rather than invalid. Google's record classifies it as CWE-787, an out-of-bounds write, and also CWE-252, an unchecked return value. The second of those is the more useful label: something returned a failure and nothing looked at it.

Fixed in 22.23.4, 24.22.1 and 26.12.1. Node 20 and earlier get nothing, because they are out of support.

The change went public in February

Here is the part that is in the primary record and not in the coverage.

The flaw is in Google's Brotli library rather than in Node, and Google is the CVE Numbering Authority for it. Google's own record carries four dates. Reserved 16 October. Published 22 October. Last updated 24 October. And date public: 27 February 2026.

So the upstream change has been visible for roughly eight months, and the notice that it is a remote code execution risk arrived this week. The fix commit's entire message is "Detect and report invalid stream earlier", which is the sort of line that nobody downstream reads as urgent.

We wrote something close to this about a Signal calling flaw fixed in September and scored 9.3 in October. The pattern is the same and the gap here is longer.

Two scores for one flaw

Google scores it 9.2 Critical on CVSS v4.0, with the vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Node rates it High in its own taxonomy. CISA's enrichment of the record records exploitation as none and automatable as no, with technical impact total.

The vector's AT:P is the honest part: attack requirements present. Somebody has to get your process to decompress Brotli data they control. That is a precondition, and it is a weaker one than it sounds.

Why fetch is the path that matters

Node's built-in fetch decodes Brotli automatically, and it decides from the Content-Encoding header the server sends back, not from what the request asked for. On all 3 supported release lines, any service that fetches a URL somebody else supplied — a link preview, a webhook handler, an image proxy, a scraper — can be made to decompress a payload the far server chose.

The request goes out from inside your network. The reply comes back and is decoded before your code sees it.

Explicit calls to the zlib Brotli functions reach the same code, and so do HTTP clients built on Node's own.

What to do

  • Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in the advisory.
  • Find every Node you actually run, not every Node you meant to run: container base images, bundled runtimes inside desktop apps, build agents, serverless layers.
  • On Debian and derivatives the fix may come from the distribution's Brotli package rather than from the Node version number, so the version string alone is not an answer.
  • If you are on Node 20 or older, this is the week that decision costs you something.
  • Treat outbound fetches of user-supplied URLs as an input path, because that is what they are.

What is not established

  • Whether anyone has been attacked through it. CISA's enrichment records no known exploitation.
  • Whether a working exploit is public. Researchers are reported to have demonstrated code execution; nothing has been published that we could read.
  • Why eight months passed between the upstream change and the advisory, or who noticed.
  • Whether Node's bundled copy or the system library is the one that matters on any given install. Node's advisory does not list Brotli among its updated dependencies and does not say.
  • How reliable exploitation is across platforms and architectures.
  • What the other nine fixed vulnerabilities are worth to you, which depends entirely on what your code does.