A single bug in one of the web’s most widely embedded compression libraries has turned into a cross-platform patching scramble. CVE-2026-111497, nicknamed Node2Shell, is an out-of-bounds write in Google’s Brotli decoder that affects Brotli 1.0.3 through 1.2.0 and carries a CVSS v4 score of 9.2. Node.js and two Python packages shipped fixes last week, and on October 25, 2026, Microsoft followed with out-of-band security updates for .NET 8, 9 and 10 plus .NET 11 Release Candidate 3. Bun, Envoy and Istio have also been updated. The catch for IT teams is that installing a patch is not the end of the job: running processes, self-contained apps and container images keep the vulnerable decoder until they are restarted or rebuilt. Here’s what the flaw does, what is actually exposed, and how to clean it up across your fleet.
The Flaw: One Decoder, Many Runtimes
Brotli is a popular compression format for web traffic, and its decoder is bundled inside a long list of runtimes, libraries and tools. A specially crafted compressed stream can make an unpatched decoder write past the end of its memory buffer, which can crash the process and, under the right conditions, open the door to code execution. The fixed upstream releases are Brotli 1.0.10, 1.1.1 and 1.2.1.
The bug was found by OpenAI’s Codex Security team during red-teaming work, and OpenAI says the underlying code had quietly been corrected months earlier. As OpenAI noted, “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli.”
Who Is Affected and What Was Patched
Because each project bundles its own copy of the decoder, each one has to ship its own fix. The patched versions IT teams should look for include:
- Node.js: 22.23.4, 24.22.1 and 26.12.1, released October 21. Node.js 20 and 25 are end-of-life and will get no fix.
- .NET: runtimes 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 RC3, released October 25. Matching SDKs include 8.0.133/8.0.427, 9.0.123/9.0.320 and 10.0.114/10.0.403. .NET Framework is not affected.
- Visual Studio and PowerShell: SecurityWeek reports that Microsoft’s October 25 updates also cover Visual Studio 2019, 2022 and 2026 and PowerShell 7.4, 7.5 and 7.6.
- Python: the Brotli 1.2.1 and brotlicffi 1.2.1.0 packages on PyPI.
- Other projects: Bun 1.4.4, along with updated Envoy and Istio releases.
Microsoft rates the .NET issue 8.1 (High) on CVSS v3.1 and classifies it as an elevation of privilege issue. SecurityWeek reports that Microsoft’s exploitability assessment is “Exploitation More Likely.” The same .NET release also fixes CVE-2026-114148, a Linux tarball ownership issue, and re-releases fixes for two flaws that the October 13 updates did not fully address.
Exposure Depends on Reachability
Not every machine with a vulnerable library is in danger. An attack only works if attacker-controlled Brotli data actually reaches the decoder. Microsoft stresses that having an affected .NET version installed does not by itself make an app exposed; the app has to decompress untrusted Brotli data. The highest-risk paths are:
- Inbound request bodies: Sysdig notes that Express 5 with default JSON parsing decodes Brotli request bodies, as do Koa-based parsers and Fastify with its compression plugin. In .NET, the risk applies only if ASP.NET Core request decompression with Brotli is turned on, and it is off by default.
- Outbound fetches: Node.js server-side fetch() decompresses Brotli responses automatically, so a webhook or URL-preview feature that calls an attacker’s server can be hit by the response. In .NET, HttpClient automatic decompression is also off by default unless it is set to include Brotli.
- Direct API use: code that calls Node’s createBrotliDecompress() or .NET’s BrotliStream and BrotliDecoder on untrusted data.
- Compressed files: OpenAI’s Patch the Planet advisory warns that “any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed,” including compressed files.
How Dangerous Is It Really?
So far, the realistic worst case is narrower than the scary nickname suggests, but the clock moved fast. Sysdig found that a public GitHub repository for the CVE appeared about five hours after the Node.js fixes shipped. Imperva demonstrated code execution on the official Node.js 24.22.0 image for Linux arm64, although it took several attempts to succeed and Imperva has not released its exploit.
Crashes are easy to reproduce, which means denial of service is the most likely outcome against any unpatched service that decodes untrusted Brotli. Some researchers argue the bug can only cause crashes, while others have shown memory disclosure. As of SecurityWeek’s October 26 report, no exploitation in the wild had been reported, and Sysdig noted the flaw was not on CISA’s Known Exploited Vulnerabilities catalog as of October 23.
Your Node2Shell Response Checklist
For techs and admins, the work this week comes down to inventory, patching in order of exposure, and making sure the fix actually took effect:
- Inventory runtimes: find every Node.js and .NET install, including CI runners, build servers, serverless functions and tools that ship their own runtime. On Windows and Linux hosts, dotnet –list-runtimes shows what .NET versions are present.
- Patch internet-facing services first: prioritize apps that accept compressed request bodies or fetch content from URLs users supply.
- Restart after patching: Microsoft says framework-dependent apps must be restarted to pick up the new runtime.
- Rebuild what carries its own copy: self-contained .NET apps, NativeAOT executables and container images must be rebuilt and redeployed. Sysdig recommends pulling fresh base images before rebuilding so cached layers don’t keep the old runtime.
- Check Linux distribution packages: some distro builds of Node.js use the system Brotli library, so the fix arrives through the distro’s Brotli package rather than a Node.js version bump.
- Reduce exposure while you patch: where clients don’t need it, consider rejecting Content-Encoding: br on request bodies at the proxy or load balancer, and in Express apps that don’t need compressed bodies, Sysdig suggests disabling inflation with express.json({ inflate: false }).
Looking Ahead
Node2Shell is a textbook example of a supply-chain problem hiding in plain sight. The bug lives in one small native library, but because that library is copied into runtimes, frameworks, proxies and desktop tools, every one of them has to ship and deploy its own fix. A public tracker of software that bundles its own Brotli decoder still lists unpatched projects, including DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II, according to SecurityWeek, so expect more updates to trickle out.
The bigger lesson is speed. AI-assisted security research is finding long-buried flaws in foundational code, and proof-of-concept exploits are now landing within a day of a patch. For IT pros, that makes a current software inventory and a reliable rebuild-and-redeploy process just as important as the patch itself.
Sources:
- Microsoft .NET Blog, October 25, 2026
- Microsoft Security Advisory CVE-2026-111497 (dotnet/announcements), October 25, 2026
- SecurityWeek, October 26, 2026
- Sysdig, October 24, 2026
