Brotli decoder out-of-bounds write (CVE-2026-111497, "Node2Shell"): Node.js, Bun and PyPI Brotli/brotlicffi affected; public PoCs, RCE shown on Node.js 24.22.0

Linha do tempo

1. aikido.dev ↗ · pub. 23/10/2026 17:45 · coletado 23/10 19:00

   Brotli decoder flaw behind Node2Shell (CVE-2026-111497) also affects PyPI packages Brotli and brotlicffi

   The Brotli flaw behind Node2Shell is not limited to Node.js and Bun: the PyPI packages Brotli (≤1.2.0) and brotlicffi (1.2.0.x) are affected. Fixes are Brotli 1.2.1 (PyPI, Oct 22) and brotlicffi 1.2.1.0 (Oct 23). Advisory databases do not yet map the CVE to PyPI, so common Python scanners will not flag it. The CVE record gives a CVSS 4.0 score of 9.2.

   ler a análise desta fonte ocultar

   The Brotli flaw behind Node2Shell is not limited to Node.js and Bun: the PyPI packages Brotli (≤1.2.0) and brotlicffi (1.2.0.x) are affected. Fixes are Brotli 1.2.1 (PyPI, Oct 22) and brotlicffi 1.2.1.0 (Oct 23). Advisory databases do not yet map the CVE to PyPI, so common Python scanners will not flag it. The CVE record gives a CVSS 4.0 score of 9.2.

   The Brotli decoder out-of-bounds write behind Node2Shell (CVE-2026-111497) also affects Python. The PyPI packages Brotli (1.2.0 and earlier) and brotlicffi (1.2.0.x) compile the same vulnerable decoder that Node.js bundles. Aikido, citing OpenSourceMalware.com (OSM) research, calls the Python variant Python2Shell. The CVE record gives it a CVSS 4.0 score of 9.2. Patched releases are Brotli 1.2.1 and brotlicffi 1.2.1.0. As of October 23, advisory databases do not map the CVE to either PyPI package, so pip-audit, Dependabot and Safety will not flag it. No in-the-wild exploitation was reported for Node.js as of October 22.

   Technical Details

   • Root causes are CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write). DecodeBlockTypeAndLength() returns a plain boolean, so BROTLI_FALSE can mean either a malformed stream or a need for more input. On the fast path the return value is discarded.
   • A crafted stream declares a single block type and exhausts its length, forcing a block switch that cannot succeed. The decoder then either keeps asking for input or continues with stale block state, which leads to the out-of-bounds write.
   • The upstream fix is google/brotli commit 0ed4268. It adds the error BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) and stops decoding on both the safe and fast paths. Version 1.2.1 differs from 1.2.0 only by the version bump and this commit.
   • OSM tested with AddressSanitizer. Brotli 1.2.0 consumed the whole ~23 MB stream and kept requesting input, even with 1-byte chunks. Brotli 1.2.1 rejected it with error -17 every time. OSM did not pursue memory corruption or code execution in the Python extension.
   • Exposure: urllib3 (and so requests), httpx (brotli extra), aiohttp and Scrapy decode Brotli automatically when the package is installed. Importing Brotli in application code is not required.
   • Attack routes: outbound requests to attacker-controlled servers (webhooks, URL previews, crawlers), and inbound request bodies sent with Content-Encoding: br.
   • In Python, brotli.decompress() raises a generic brotli.error. A Decompressor() fed the stream incrementally never finishes on 1.2.0.

   Remediation

   • Run pip install -U "Brotli>=1.2.1" or pip install -U "brotlicffi>=1.2.1.0", and regenerate Poetry, uv or pip-tools lockfiles.
   • Rebuild container images and wheels that bundle either package. Check laptops, CI runners, servers and containers.
   • Use pip show Brotli brotlicffi, pipdeptree -r -p Brotli and grep -i brotli on lockfiles to find exposure. Prioritise services that fetch from untrusted servers or accept Brotli request bodies.
   • If you cannot upgrade, uninstall Brotli and brotlicffi (and extras such as httpx[brotli]); clients fall back to gzip and deflate. Stripping br from Accept-Encoding or rejecting Content-Encoding: br at the edge only partly helps, because a malicious server can still send Brotli responses.
   • Distribution-packaged bindings are fixed through the distro advisory.
2. thehackernews.com ↗ · pub. 23/10/2026 04:50 · coletado 23/10 05:00

   Imperva demonstrates Node2Shell RCE on official Node.js 24.22.0 build via crafted Brotli data (CVE-2026-111497)

   Imperva attributes the Node2Shell demonstration on the unmodified official Node.js 24.22.0 linux/arm64 image (several attempts needed, other architectures and 22.x/26.x untested). It reproduced execution through both fetch() responses and request-body middleware (Express 5.0.0-5.3.0, body-parser 2.0.0-2.3.0), explained the root cause (impossible block-type change handled as a request for more input) and noted its own WAF rules alongside Vercel's.

   ler a análise desta fonte ocultar

   Imperva attributes the Node2Shell demonstration on the unmodified official Node.js 24.22.0 linux/arm64 image (several attempts needed, other architectures and 22.x/26.x untested). It reproduced execution through both fetch() responses and request-body middleware (Express 5.0.0-5.3.0, body-parser 2.0.0-2.3.0), explained the root cause (impossible block-type change handled as a request for more input) and noted its own WAF rules alongside Vercel's.

   Researchers at Imperva demonstrated Node2Shell, a proof of concept that achieves code execution on the official Node.js 24.22.0 Linux arm64 image by feeding crafted data to the bundled Brotli decoder (CVE-2026-111497). Node.js disclosed the flaw and shipped fixes on October 21. The demonstration goes beyond the first public PoC, which worked only on a deliberately weakened build; on a standard build that PoC produced only a crash and a limited memory read. Imperva's exploit was unreliable and needed several attempts, and it covers only that one build and setup. No in-the-wild exploitation had been reported as of October 22.

   Technical Details

   • The flaw sits in the bundled Brotli decoder, so it affects the 22.x, 24.x and 26.x lines, not only the build Imperva tested. Other architectures and the 22.x and 26.x lines were not tested.
   • Reachable from both sides of an HTTP exchange: Brotli-compressed responses read through the built-in fetch(), and Brotli request bodies decoded by middleware. Express 5 body parsers (express.json(), express.urlencoded(), express.text(), express.raw()) now decode Brotli request bodies. A plain Node.js HTTP server does not decode them without middleware or an explicit call.
   • Imperva reproduced code execution through both the request-body and response paths, testing Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 at pinned versions only.
   • Root cause: the test input reached a block-type change that the stream's own structure ruled out. The vulnerable decoder treated it as a request for more input and continued in an invalid state. A separate memory-sanitizer test showed a write past an intended buffer (out-of-bounds write).
   • Node.js fixed it by importing an upstream Brotli patch that stops the decoder with a format error at that point. On 24.22.1 the same data was rejected and no code ran.

   Remediation

   • Move to a patched release, including container images and other artifacts that bundle a Node binary, which package inventories can miss.
   • End-of-life lines 20.x and earlier get no fix and must move to a supported line.
   • The advisory lists no workaround. Imperva suggests limiting untrusted Brotli traffic on affected paths where practical; only the update removes the flaw.
   • Imperva added WAF rules and tested them against its reproduced attacks. Vercel added rules on October 21 that block the attack in inbound requests; they do not cover Brotli responses fetched from other servers and do not replace updating.
3. aikido.dev ↗ · pub. 22/10/2026 15:11 · coletado 22/10 17:00

   Node2Shell: Brotli decoder out-of-bounds write in Node.js and Bun (CVE-2026-111497) enables potential RCE; patches released

   ler a análise desta fonte ocultar

   Node.js released security updates on October 21, 2026 for CVE-2026-111497 (nicknamed Node2Shell), an out-of-bounds write in the bundled Brotli decoder. Malformed compressed input can crash the process, leak memory or potentially give an attacker code execution. Node.js rates it high severity, and Bun is also affected. A public proof of concept appeared on October 22, and researchers reported code execution against an unmodified Node.js 24.22.0 image on Linux arm64, although the exploit was unreliable. Per The Hacker News, no in-the-wild exploitation had been reported as of October 22.

   Technical Details

   • The flaw is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. The upstream fix is Brotli commit 0ed4268a (February 2026), also shipped in Brotli 1.2.1, 1.1.1 and 1.0.10. It makes the decoder detect invalid input and stop before writing past the buffer.
   • Exposure paths: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br; fetch() automatically decompresses Brotli responses from attacker-controlled or compromised servers (webhooks, user-supplied URLs); direct use of node:zlib Brotli functions with untrusted input. A bare Node.js HTTP server does not decode incoming Brotli bodies on its own.
   • The first public PoC reached code execution only against a deliberately weakened build. Researchers later reported code execution on the official Node.js 24.22.0 image (linux/arm64), not on every attempt; 24.22.1 rejects the same input.
   • Distribution builds that use the system Brotli library are fixed through the distro's Brotli package.

   Remediation

   • Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1 (or newer patch releases of those lines), and Bun 1.4.4 or newer.
   • Rebuild and redeploy container images, because images pinned to earlier tags (e.g. node:22.23.3-alpine, node:24.22.0) stay vulnerable.
   • Node.js 25.x, 23.x, 20.x and earlier are end of life and get no fix, so plan a migration.
   • Prioritise services that call external servers or accept compressed request bodies.
   • The Node.js advisory lists no workaround. Stopgaps: drop requests with Content-Encoding: br at the proxy, load balancer or middleware, or use Vercel firewall rules (added October 21). Neither stopgap covers Brotli responses the app fetches.
   • Check managed platforms' bundled runtimes and your distribution's security advisories.
4. thehackernews.com ↗ · pub. 22/10/2026 04:47 · coletado 22/10 08:00

   Node.js patches Brotli decoder out-of-bounds write (RCE per vendor) and 9 other flaws; blocks eight compromised eMudhra CA keys

   ler a análise desta fonte ocultar

   Node.js released security updates on October 21 for the 22.x, 24.x and 26.x lines (fixed in 22.23.4, 24.22.1 and 26.12.1), addressing 10 flaws. The most serious is an out-of-bounds write in the bundled Brotli decoder, which the project says could allow remote code execution. It is rated high, not critical. A public proof-of-concept published October 22 achieved code execution only against a deliberately weakened test build. On standard builds it produced a crash and a limited memory read, and no in-the-wild exploitation had been reported as of October 22. The same updates also block eight intermediate CA keys from Indian provider eMudhra that were reported compromised, and remove three emSign roots from the bundled root list.

   Technical Details

   • Brotli flaw: an out-of-bounds write in the decoder, triggered by malformed compressed input. No CVE is stated in the article. Node.js reaches the code through node:zlib or automatically through fetch() on Brotli-compressed responses. Applications are exposed when they decompress attacker-controlled Brotli data, such as request bodies or responses fetched from another server.
   • The fix is an upstream Brotli patch, first made in Brotli's source in February 2026 and shipped as a security release in October. It also shipped in Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, so other software bundling Brotli may need updating.
   • Other high-severity fixes: two TLS certificate check bypasses that use unusual IP address forms (CVE-2026-106069, CVE-2026-105483), and dns.resolve truncating hostnames at an embedded null byte (CVE-2026-105482). The commit fixing CVE-2026-105483 calls it low-severity and hard to exploit.
   • Medium flaw: CVE-2026-106074 makes crypto.randomUUID() and crypto.randomInt() return the same values across processes in startup-snapshot or single-executable applications.
   • eMudhra block: Node.js does not perform revocation checks by default, so chains built on the compromised keys previously validated. Sessions resumed from before the update are not re-checked until they time out. Go made the same block on October 20.
   • Bundled components refreshed: undici (three moderate advisories, including a Subresource Integrity check issue and two memory-exhaustion flaws), c-ares, OpenSSL (22.x and 24.x) and SQLite (22.x).

   Remediation

   • Upgrade to 22.23.4, 24.22.1 or 26.12.1. Node.js 20.x and earlier are end of life and get neither the fix nor the eMudhra block, so they must move to a supported line.
   • The advisory offers no workaround for the Brotli flaw.
   • Vercel added firewall rules on October 21 that block the attack in inbound requests. They do not cover Brotli responses fetched from other servers and do not replace upgrading.
   • Check other software that bundles Brotli for the corresponding patched versions.
5. gbhackers.com ↗ · pub. 22/10/2026 02:46 · coletado 22/10 04:00 primeiro registro

   Node.js patches 10 vulnerabilities, including Brotli decoder out-of-bounds write enabling RCE (CVE-2026-111497)

   ler a análise desta fonte ocultar

   The Node.js Project released security updates on October 21, 2026 fixing 10 vulnerabilities (four high, three medium, three low severity) across the 26.x, 24.x and 22.x release lines. The most significant is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that allows remote code execution in all three lines. The advisory gives no exploitation prerequisites and no evidence of active exploitation. Patched versions are 26.12.1, 24.22.1 and 22.23.4.

   Technical Details

   • CVE-2026-111497: out-of-bounds write in the Brotli decoder leading to RCE (26.x, 24.x, 22.x). Reported by mcollina, fixed by aduh95.
   • CVE-2026-105482: dns.resolve truncates names containing NUL characters.
   • CVE-2026-105483: TLS certificate hostname check bypass when an IP address uses full-width digits.
   • CVE-2026-106069: affects hosts that loosely resolve to IP addresses.
   • CVE-2026-106074: entropy caches used by crypto.randomUUID() and randomInt() can be preserved in user-land startup snapshots and single-executable applications, so processes repeat the same values. This is limited to duplicated cached randomness, not a general cryptographic failure.
   • The release also updates c-ares, Undici and CA certificates in all branches. The certificate update addresses the eMudhra Intermediate CA compromise. OpenSSL is updated in 24.x and 22.x, and SQLite in 22.x.
   • Individual vulnerabilities affect different branches, so version-specific assessment is needed. Severity labels are the project's own.

   Remediation

   • Upgrade to Node.js 26.12.1, 24.22.1 or 22.23.4, depending on the release branch.
   • No workarounds are offered.
   • End-of-life versions remain affected even after these releases, so move to a maintained version.