What is Node2Shell?

Brotli is a compression format used for HTTP Content-Encoding: br. Node.js ships its own copy of Google's Brotli C library inside the runtime and exposes it through node:zlib, fetch() and any middleware that decodes compressed bodies.

The Node.js advisory describes the bug precisely: an invalid block switch in the compressed stream "was reported as a temporary need for more input instead of a permanent format error," so the streaming decoder kept appending input bytes to an eight-byte internal buffer. Writing past that buffer is an out-of-bounds write (CWE-787) in native memory, the classic starting point for code execution. Upstream Brotli fixed it by returning a format error for that transition, in versions 1.0.10, 1.1.1 and 1.2.1.

Node.js rates it High; the CVE record from Google, the Brotli maintainer, scores it 9.2 on CVSS v4. The name Node2Shell came from the researchers who demonstrated code execution on the official Node.js 24.22.0 image.

A bare Node.js HTTP server does not decode Brotli bodies on its own. Exposure depends on whether attacker-controlled Brotli data reaches the decoder. Shown for defensive context, the paths are:

• Inbound request bodies. Express 5 (5.0.0 to 5.3.0) and body-parser 2.x (2.0.0 to 2.3.0) inflate bodies sent with Content-Encoding: br when using express.json() or raw(). A single crafted POST with that header and a malformed Brotli body reaches the bug.
• Outbound responses. The built-in fetch() decodes Brotli responses. A server-side app that fetches URLs an attacker can influence, such as webhooks, link previews or SSRF-prone features, can be fed a malicious response.
• Direct decompression. Any code calling zlib.brotliDecompress() or createBrotliDecompress() on uploaded files or message payloads.

The researchers report that code execution took multiple attempts in their lab, and as of October 23, 2026 no exploitation in the wild had been confirmed and the CVE was not on the CISA KEV list. Crashing the process is far easier, so even a failed exploit is a denial-of-service.

Check the runtime that is actually deployed, not the version in your laptop's shell:

• Node version: node -v inside every container image, serverless runtime and host. Vulnerable on 22.x below 22.23.4, 24.x below 24.22.1 and 26.x below 26.12.1. End-of-life lines 20.x, 23.x and 25.x get no fix.
• Bundled Brotli: node -p process.versions.brotli shows the decoder version compiled into the runtime.
• Other runtimes: Bun is fixed in 1.4.4. Electron apps and single-executable Node binaries carry their own runtime and need their own rebuild.
• Middleware: search your code for express.json, body-parser and brotliDecompress, and check whether any service accepts Content-Encoding: br from the internet.
• Signals: unexpected process exits or decoder errors during decompression. They are not proof of exploitation, but correlate them with the runtime version and the source of the compressed data.

Upgrade the runtime to Node.js 22.23.4, 24.22.1 or 26.12.1 or later in your line, then rebuild and redeploy every image that embeds Node, because each image carries its own copy of the decoder. The Node.js advisory lists no workaround.

While updates roll out:

• Reject `Content-Encoding: br` on inbound requests at the reverse proxy, load balancer or middleware for paths that do not need compressed uploads. Few public APIs do.
• Limit what server-side fetch can reach, and strip br from the Accept-Encoding header on outbound requests to untrusted hosts.
• Move off end-of-life lines (20.x and older, 23.x, 25.x), which will not receive this or future fixes.

The same decoder is bundled in Python and other HTTP stacks, so check them too. See HTTP2Shell for that wider exposure.