Critical Node.js Brotli vulnerability identified as Node2Shell

Picus Security has released details regarding a critical vulnerability, dubbed Node2Shell (CVE-2026-111497), affecting the Node.js runtime. With a CVSS score of 9.2, the flaw resides in the Brotli decompression library bundled with Node.js and can be exploited to achieve remote code execution, system crashes, or unauthorized data access.

The vulnerability is triggered by a failure in the Brotli decoder to properly handle impossible stream states. When presented with a specifically crafted Brotli stream, the decoder ignores internal errors and proceeds from a corrupted state, resulting in an out-of-bounds write. This allows an attacker to overwrite memory and potentially execute arbitrary commands, posing a significant risk to any service that decompresses untrusted data.

Patching is available in Node.js versions 22.23.4, 24.22.1, and 26.12.1. Importantly, versions 20.x and 25.x have reached end-of-life status and remain unpatched, leaving users of these versions exposed. Additionally, Bun users should upgrade to at least version 1.4.4. Picus Security notes that because some Linux distributions link Node.js to system-level Brotli libraries, system-wide updates may be required in addition to runtime patching.

To assist in mitigation, Picus Security has added attack simulations to its threat library. Security teams are encouraged to identify and patch affected instances to prevent risks including credential theft and the deployment of malicious software.