CVE-2026-111497, nicknamed Broccoli2Shell (also tracked as Node2Shell and HTTP2Shell in vendor write-ups), is an out-of-bounds write in the Brotli C decoder maintained by Google. Crafted compressed input can write past the end of a buffer, and researchers have demonstrated remote code execution against unpatched Node.js. GitHub scores it CVSS v4.0 9.2; the Node.js project rates its own exposure High. Public proof-of-concept code has circulated since October 22. As of October 23 it was not in CISA’s KEV catalog, and no source we reviewed confirms in-the-wild exploitation, though one threat-intel report describes someone building target lists of Brotli-capable hosts.

What Happened

The flaw sits in the block-switch handling of the Brotli decoder. Malformed input makes the decoder continue past a state it should reject, producing a heap write beyond the allocated buffer. Node.js published fixed releases on October 21, and the upstream Brotli project released patched library versions. Wiz, Sysdig and others published analyses and detection guidance; PoCs followed a day later.

Technical Details

  • Root cause: out-of-bounds write in the Brotli decoder. The upstream fix makes the decoder return a hard format error (BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH) instead of continuing; Node.js exposes the new error constant.
  • Affected Brotli library: 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1.
  • Affected Node.js: 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1. Node.js 25.x, 23.x, 20.x and older have no fix and must move to a supported line.
  • Trigger condition: the application, or a dependency, must decompress attacker-controlled Brotli data. That covers Content-Encoding: br request bodies, upstream HTTP responses fetched by server-side code, proxies and API gateways that decode on the fly, and any file-processing path that accepts .br content.

Because the decoder is a shared C library, exposure is not limited to Node.js. Python brotli bindings, web servers and reverse proxies built with libbrotli, HTTP client libraries, and container base images that carry their own copy are all candidates. Sources disagree on whether Node.js uses a bundled copy or the system library in a given build: the bundled copy makes the Node.js version number authoritative, while distro-linked builds depend on the distro’s libbrotli package. Debian had no patched packages as of October 23.

Impact

Any internet-facing service that decodes Brotli from untrusted clients or upstreams is a potential RCE target, running with the privileges of the application process. In containerised deployments that usually means access to service credentials, environment secrets and the cluster network. Server-side fetchers (webhooks, link unfurlers, SSRF-adjacent features) widen the surface, since an attacker only needs to serve a malicious Brotli response. Exploit reliability against hardened allocators is not established, so crashes and denial of service are the more probable outcome for unsophisticated attempts, but public PoCs lower the bar considerably.

Mitigation

  1. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and rebuild container images; do not rely on apt upgrade alone if the image pins its own runtime.
  2. Update standalone Brotli to 1.2.1, 1.1.1 or 1.0.10 wherever it is linked or vendored, including Python brotli wheels, and watch distro advisories for libbrotli updates.
  3. Restart processes after patching; long-running services keep the old library mapped.
  4. Inventory consumers: search images and SBOMs for libbrotli, brotli packages and bundled Node.js binaries.
  5. Interim hardening: where patching is delayed, strip or reject Content-Encoding: br on inbound requests at the edge, disable Brotli decoding in server-side HTTP clients, and run services with minimal privileges and read-only filesystems to limit post-exploit impact.
  6. Detect: alert on unexpected Node.js worker crashes and on inbound requests with Brotli request bodies, which are rare in legitimate traffic.

References