CVE-2026-111497
CVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.
Last reviewed
Updates
Cloudflare documented two WAF rules and their default Log action.
Node.js published security-release guidance for the vulnerability.
Overview
Details
node2shell is the early name for CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The decoder can mistake a malformed block switch for a temporary lack of input, continue appending bytes to a small internal buffer, and corrupt process memory.
The name can be misleading: the flaw is in a widely reused Brotli library, not in Node.js alone. It can reach applications through runtimes, HTTP clients, framework middleware, and container images that bundle or install the decoder.
In Node.js, applications can reach the decoder through node:zlib or Brotli-aware request middleware. Node.js built-in fetch is powered by Undici and automatically handles Brotli responses, so server-side URL fetches and remote-image features require review too. Next.js remote image optimization is one such path. Gzip, Deflate, and Zstd use different decoders. Remediation guidance was still developing at the October 25 review.
Risk
The decoder is used beyond Node.js, including in server-side fetches. The October 25 review did not confirm active exploitation.
Affected deployments
Services that use a vulnerable Brotli decoder, including bundled copies in runtimes and container images. Node.js request middleware and server-side fetches both need review.
Recommended action
Update or remove vulnerable Brotli decoders using each vendor's guidance, including copies bundled with runtimes or container images.
Inventory runtimes, HTTP libraries, dependencies, and container images that provide Brotli decoding.
Apply the security update or vendor guidance for every affected component, then rebuild and redeploy affected workloads.
Prioritize inbound Brotli request handling and outbound fetch, webhook, crawler, URL-preview, proxy, and remote-image features that retrieve untrusted responses.
Cloudflare coverage
Service status
No impact; Brotli is not currently used in Cloudflare infrastructure.
Product coverage
Cloudflare has WAF rules for documented Node2Shell request patterns. They default to Log and customers must configure them to Block if blocking mitigation is needed.
Review your WAF configuration to determine whether you are protected.
Evidence and sources
CVE record
Technical research
How the shared decoder reaches applications outside Node.js.