CVE-2026-111497
CVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.
Last checked
Update chronology
Node.js published security-release guidance for the vulnerability.
Cloudflare documented two WAF rules and their default Log action.
Overview
What happened
node2shell is the early name for CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The decoder can mistake a malformed block switch for a temporary lack of input, continue appending bytes to a small internal buffer, and corrupt process memory.
The name can be misleading: the flaw is in a widely reused Brotli library, not in Node.js alone. It can reach applications through runtimes, HTTP clients, framework middleware, and container images that bundle or install the decoder.
In Node.js, applications can reach the decoder through node:zlib or Brotli-aware request middleware. Node.js built-in fetch is powered by Undici and automatically handles Brotli responses, so server-side URL fetches and remote-image features require review too. Gzip, Deflate, and Zstd are not the decoder affected by this CVE. The cited sources do not establish active exploitation.
Why this needs attention
The risk extends beyond Node.js deployments, and affected runtime and server-side fetch paths require active assessment. Active exploitation is not established in the reviewed sources, but scope and remediation guidance are still developing.
Who should investigate
Teams should investigate runtimes, HTTP clients, libraries, and container images that include a vulnerable Brotli decoder. For Node.js, review direct node:zlib use, Brotli-inflating request middleware, and server-side fetches of untrusted URLs. Next.js remote image optimization is a documented server-side response path.
What to do now
Identify every Brotli decoder in running runtimes, dependencies, and container images, then use each vendor's security guidance to update or otherwise remove the vulnerable decoder.
Inventory runtimes, HTTP libraries, dependencies, and container images that provide Brotli decoding.
Apply the security update or vendor guidance for every affected component, then rebuild and redeploy affected workloads.
Prioritize inbound Brotli request handling and outbound fetch, webhook, crawler, URL-preview, proxy, and remote-image features that retrieve untrusted responses.
Cloudflare coverage
Product coverage
Cloudflare has WAF rules for documented Node2Shell request patterns. They default to Log and customers must configure them to Block if blocking mitigation is needed.
Review your WAF configuration to determine whether you are protected.
Service status
No impact; Brotli is not currently used in Cloudflare infrastructure.
Evidence and sources
Vendor advisory
Authoritative Node.js remediation guidance and affected-release information.
CISA KEV
KEV inclusion was not established in the sources reviewed for this snapshot.
Technical research
Independent research describes the shared-library and HTTP attack-path context beyond Node.js deployments.
Exploit evidence
The sources reviewed do not establish active exploitation.