Node2Shell: Brotli Decoder Flaw Lets Attackers Target Node.js and More

What the flaw does

Node2Shell is an out-of-bounds write in the Brotli decoder, the code that expands Brotli-compressed data. SentinelOne describes the weakness as an unchecked return value (CWE-252) leading to an out-of-bounds write (CWE-787), with no authentication required.

A Brotli stream signals switches between block types. If a stream declares only one block type, a switch is invalid and the decoder should reject it. The vulnerable decoder instead reported the invalid switch as a request for more input. The caller supplied more bytes, and the decoder kept appending them to an eight-byte internal buffer and wrote past its end, according to the Node.js advisory.

Google, as the CVE Numbering Authority, scored the flaw 9.2 under CVSS v4.0. Node.js rates it high. Because the bug sits in Google's Brotli library, it reaches software well beyond Node.js, which is why vendors use names such as Brotli2Shell, Broccoli2Shell and HTTP2Shell. Affected Brotli versions are 1.0.3 through 1.0.9, 1.1.0 and 1.2.0.

How attacker data reaches the decoder

A default Node.js server is not exposed by itself. Something must hand attacker-controlled Brotli data to the decoder. SentinelOne lists three paths:

• Inbound request bodies: routes using express.json(), express.urlencoded(), express.text() or express.raw() in Express 5 or body-parser 2 decompress bodies sent with Content-Encoding: br by default, and any client can send one.
• Outbound responses: built-in fetch() decodes Brotli automatically, so a malicious or compromised server can target the client.
• Direct calls: applications that pass untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().

Imperva demonstrated code execution on the official Node.js 24.22.0 arm64 image through fetch() and Express 5 request bodies. It needed multiple attempts and did not test every Node.js build. Even a failed exploit has a cost: the Node.js advisory lists a crash as an outcome, and Sysdig reports that crashes have been easy to reproduce, which makes repeated denial of service possible.

Exploitation and timeline

Exploitation attempts have been recorded, but SentinelOne says that as of October 29, 2026 it knows of no public report of a confirmed compromise of a production system. ELLIO saw a request built for Node.js 24.22.0 on x86-64 on October 26, and Previdian saw one from a U.S.-based address on October 27, both on honeypot sensors. Previdian notes such observations do not show the target was vulnerable or that the attempt succeeded.

According to Sysdig, public proof-of-concept code appeared within hours of the October 21 release. CISA set a November 10, 2026 deadline for federal civilian agencies under BOD 26-04.

Key dates in 2026:

• February 27: Google commits the upstream fix with no release and no advisory.
• October 21: Node.js discloses the CVE, and Google releases Brotli 1.0.10, 1.1.1 and 1.2.1.
• October 22: Imperva demonstrates code execution on arm64, and the CVE record is published.
• October 25: Microsoft releases out-of-band .NET security updates.
• October 27: CISA adds the CVE to the KEV catalog.

Patches and what to do

Each affected project shipped its own fix, so updating one does not update the others. SentinelOne lists fixes for Node.js, Google Brotli, Bun, .NET, PHP for Windows, Python, Envoy and Istio.

• Node.js: 22.23.4, 24.22.1 or 26.12.1.
• Google Brotli: 1.0.10, 1.1.1 or 1.2.1.
• Bun: 1.4.4 for versions 1.0.21 through 1.4.3.
• Microsoft .NET: 8.0.33, 9.0.22, 10.0.14 or 11 RC3. .NET Framework is not affected.
• Python: Brotli 1.2.1 and brotlicffi 1.2.1.0.

End-of-life Node.js 20, 23 and 25 are not expected to receive a fix, so those users must move to a supported line.

SentinelOne advises upgrading Node.js, restarting processes and rebuilding container images, then inventorying every other runtime and library that embeds the Brotli decoder, starting with internet-facing services. Where patching must wait, it suggests rejecting inbound requests carrying Content-Encoding: br at the proxy or load balancer. It also advises confirming patch status from the Node.js release version running in each workload, not from a bundled library version string, which may not reflect a backported fix.