IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attacker-controlled Brotli data. Successful exploitation may result in process crashes, disclosure of process memory, or remote code execution (RCE). Imperva reported demonstrating code execution in fresh containers running the official Node.js 24.22.0 Linux arm64 image, with multiple attempts required in its test environment. The vulnerable Brotli decoder may be present in a range of runtimes, libraries, and software packages, including Node.js, Bun, Python Brotli bindings, .NET, Envoy Proxy, Istio, Java brotli4j, libbrotli, curl/libcurl through Brotli dependencies, and Linux distribution packages. Applications may be exposed if they decompress attacker-controlled data using a vulnerable decoder. The vulnerability may be reachable through both inbound and outbound traffic paths. A malicious client could send a crafted request with Content-Encoding: br to a vulnerable server-side component that performs Brotli request decompression. Conversely, a malicious or compromised server could return a crafted Brotli-compressed response to a vulnerable client application that automatically decodes Brotli responses. ThreatLabz has observed reconnaissance and exploitation attempts targeting this vulnerability through Zscaler Deception, as detailed in the ThreatLabz Observations section below. RecommendationsZscaler recommends the following measures to address CVE-2026-111497 and monitor for potentially related activity:Patch vulnerable runtimes and libraries. Upgrade vulnerable runtimes, packages, and infrastructure components to the patched versions listed in the Vulnerable Versions table. Prioritize services that decompress untrusted Brotli data, including internet-facing applications that accept compressed request bodies and services that fetch content from external or user-controlled URLs. Validate each vulnerable component independently. Updating the system-wide libbrotli package may not remediate applications that statically bundle Brotli or ship their own decoder copy.Rebuild and redeploy containers. Use patched base images, runtimes, and libraries, and verify the versions in running workloads. Updating a host’s libraries does not update copies bundled within container images.Disable Brotli decoding where patching is delayed. If immediate patching is not possible, disable Brotli decompression on vulnerable paths where supported, following vendor guidance and testing for application compatibility.Monitor for exploitation and post-exploitation behavior. Investigate the following: Unexpected process crashes in Node.js, Bun, Python, .NET, Envoy Proxy, or service mesh workloads.Repeated malformed Brotli payloads.Requests containing Content-Encoding: br to endpoints that normally do not receive compressed request bodies.Abnormal memory access violations or segmentation faults.Web server or application worker crashes after compressed request handling.Unexpected child processes spawned by web application runtimes.Unexpected outbound connections following crashes or the processing of malformed compressed input. Vulnerable VersionsThe following table lists vulnerable versions and corresponding fixes for selected software that incorporates the Brotli decoder. ProductVulnerable VersionsPatched VersionsGoogle Brotli1.0.3 < 1.0.10 (semver)1.0.10Google Brotli1.1.0 < 1.1.1 (semver)1.1.1Google Brotli1.2.0 < 1.2.1 (semver)1.2.1Node.js22.0.0 – 22.23.322.23.4Node.js24.0.0 – 24.22.024.22.1Node.js26.0.0 – 26.12.026.12.1Bun< 1.4.41.4.4.NET8.0.0 – 8.0.328.0.33.NET9.0.0 – 9.0.219.0.22.NET10.0.0 – 10.0.1310.0.14.NET11.0.0-preview.1 – 11.0.0-rc.211.0.0-rc.3.26522.148Python Brotli (PyPI)1.2.01.2.1Python brotlicffi (PyPI)1.2.0.0 – 1.2.0.21.2.1.0Envoy Proxy1.39.2, 1.38.5, 1.37.7, 1.36.111.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12Java brotli4j< 1.24.01.24.0libbrotli (Debian)1.1.0-21.1.0-2+deb13u1libbrotliVaries by distributionApply vendor security updatesTable 1: Software versions vulnerable to CVE-2026-111497 and the corresponding patched versions. ThreatLabz ObservationsThreatLabz observed reconnaissance and exploitation attempts involving CVE-2026-111497 through Zscaler Deception. Within the first 24 hours following public disclosure, Zscaler Deception’s global decoy mesh observed activity from 20 source IP addresses targeting 12 customers across 402 events. Of these events, 40% involved reconnaissance and 60% involved exploitation attempts. The table below summarizes the unique payloads associated with reconnaissance and exploitation attempts targeting CVE-2026-111497 observed through Zscaler Deception.Payload DescriptionJA4 FingerprintMalformed Brotli stream headers + valid Brotli differential check + Node.js path recont13d4312h1_c7886603b240_b26ce05bbdd6Truncated JSON Brotli + 8-byte invalid Brotli padding stream + uncompressed controlsNone22-byte & 23-byte invalid block-switch OOB-write seeds (CVE-2026-111497)t13d251100_b78ed14e2fd0_ab7e3b40a677Brotli decompression bomb / Celery stream probe + 1B controlsNoneAssetnote 1-byte malformed/valid Brotli differential checkMultiple observed3-stage Node2Shell capability, Strapi & CVE-2026-111497 JSON parser probet13d521100_b262b3658495_8e6e362c5eac14-byte Brotli {“ping”:1} differential sweept13d1714h1_ab0a1bf427ad_5e078a691127Table 2: Unique payloads observed during reconnaissance and exploitation attempts targeting CVE-2026-111497. How It WorksBrotli is a lossless compression algorithm and data format developed by Google. It is used for HTTP compression to reduce the size of web content such as HTML, CSS, JavaScript, JSON, and API responses. Brotli-encoded HTTP content is identified by the Content-Encoding: br header.Applications may use Brotli directly or through dependencies such as runtimes, frameworks, HTTP clients, and middleware. In some configurations, these components automatically decompress Brotli-encoded content without application code explicitly calling Brotli APIs.Vulnerability detailsThe flaw occurs in Brotli’s block-decoding logic. When a stream changes block type, the decoder determines the next block type and length. In vulnerable versions, there is a macro (in the fast-path logic) that does not properly check the return value of the DecodeBlockTypeAndLength function, which can cause the decoder to continue processing an invalid state (e.g., when provided a maliciously crafted Brotli stream). This can lead to an out-of-bounds write and be used as a primitive for RCE. The upstream fix modifies the decoder so malformed block-switch conditions return a distinct error that is propagated to the caller, stopping further decoding of the malicious Brotli stream.Attack chainExploitation of CVE-2026-111497 may follow either an inbound or outbound path, depending on where Brotli decompression occurs, as shown in the figure below. Inbound attempts use crafted Brotli-compressed HTTP request bodies while outbound attempts use crafted responses returned by an attacker-controlled or compromised server. These responses may be consumed through fetch(), webhook delivery, URL previews, crawlers or scrapers, and API integrations. In either path, exploitation requires attacker-controlled Brotli data to reach a vulnerable decoder, with compressed HTTP content marked by Content-Encoding: br. Figure 1: Potential inbound and outbound exploitation paths for CVE-2026-111497. ConclusionCVE-2026-111497 affects the Brotli decoder used by Node.js and other software. Exposure depends on whether an application passes attacker-controlled Brotli data to a vulnerable decoder. Organizations should identify vulnerable components and apply corresponding vendor updates, including updates for applications that bundle their own copy of Brotli.Zscaler Deception has observed active reconnaissance and exploitation attempts involving this vulnerability. ThreatLabz will continue monitoring for related activity and provide updates as additional findings become available. Zscaler CoverageZscaler Private Access (ZPA) App ProtectionThe following ZPA App Protection signature detects attempts to exploit CVE-2026-111497 in internal applications accessed through ZPA, including activity originating from compromised endpoints or insiders:App.Exploit.CVE-2026-111497Zscaler Deception Organizations should deploy the following Zscaler Deception decoys to help detect reconnaissance and exploitation attempts:MLflowMetaflowBento FrontendRay ServeGitLab How Zscaler Can HelpThe following table shows the typical attack stages and the mitigations recommended by Zscaler.Attack StageRecommended MitigationMinimize the external attack surfaceIdentify internet-facing applications containing vulnerable versions using Zscaler Exposure Management.Find services running vulnerable runtimes or libraries.Reduce direct exposure by placing applications behind a Zero Trust architecture.Prevent compromiseEnable SSL/TLS inspection where appropriate. Use Advanced Threat Protection to detect exploit attempts and suspicious payload delivery. Use ZPA App Protection to inspect and block suspicious requests targeting private applications. Reduce outbound exploitation riskRoute server egress through Zscaler Internet Access (ZIA) to inspect outbound traffic.Restrict application egress to approved destinations. Pay special attention to webhook, crawler, URL preview, and third-party integration services that fetch content from external or user-controlled URLs.Prevent lateral threat movementUse ZPA to enforce least-privilege user-to-application segmentation.Use Zscaler Deception to detect attacker movement after initial compromise. Monitor for suspicious access to internal applications following web application crashes or abnormal behavior.Detect post-exploitation activityUse Zscaler Managed Detection & Response (MDR) and Threat Hunting to investigate suspicious process behavior, command execution, unusual outbound connections, container runtime anomalies, and web application worker crashes.Prevent data lossInspect outbound traffic across channels with Zscaler Data Loss Prevention (DLP).Monitor for unusual uploads, archive transfers, credential exposure, or data movement following suspected exploitation. Indicators Of Compromise (IOCs)Source IP AddressActivity Type49.37.46.99Exploitation34.10.240.142Exploitation188.245.184.87Exploitation52.46.50.66Exploitation136.111.197.96Exploitation172.105.229.89Reconnaissance 49.36.35.148Reconnaissance 15.158.231.107Reconnaissance 172.235.194.230Reconnaissance 103.121.38.163Reconnaissance 213.136.92.88Reconnaissance 105.213.105.48Reconnaissance 172.105.95.212Reconnaissance 104.105.82.150Reconnaissance 172.233.109.39Reconnaissance 172.232.175.104Reconnaissance 3.172.4.141Reconnaissance 104.234.140.104Reconnaissance 104.234.140.110Reconnaissance 104.234.140.114Reconnaissance
[#item_full_content] IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0. The flaw can be triggered when a vulnerable process decompresses attacker-controlled Brotli data. Successful exploitation may result in process crashes, disclosure of process memory, or remote code execution (RCE). Imperva reported demonstrating code execution in fresh containers running the official Node.js 24.22.0 Linux arm64 image, with multiple attempts required in its test environment. The vulnerable Brotli decoder may be present in a range of runtimes, libraries, and software packages, including Node.js, Bun, Python Brotli bindings, .NET, Envoy Proxy, Istio, Java brotli4j, libbrotli, curl/libcurl through Brotli dependencies, and Linux distribution packages. Applications may be exposed if they decompress attacker-controlled data using a vulnerable decoder. The vulnerability may be reachable through both inbound and outbound traffic paths. A malicious client could send a crafted request with Content-Encoding: br to a vulnerable server-side component that performs Brotli request decompression. Conversely, a malicious or compromised server could return a crafted Brotli-compressed response to a vulnerable client application that automatically decodes Brotli responses. ThreatLabz has observed reconnaissance and exploitation attempts targeting this vulnerability through Zscaler Deception, as detailed in the ThreatLabz Observations section below. RecommendationsZscaler recommends the following measures to address CVE-2026-111497 and monitor for potentially related activity:Patch vulnerable runtimes and libraries. Upgrade vulnerable runtimes, packages, and infrastructure components to the patched versions listed in the Vulnerable Versions table. Prioritize services that decompress untrusted Brotli data, including internet-facing applications that accept compressed request bodies and services that fetch content from external or user-controlled URLs. Validate each vulnerable component independently. Updating the system-wide libbrotli package may not remediate applications that statically bundle Brotli or ship their own decoder copy.Rebuild and redeploy containers. Use patched base images, runtimes, and libraries, and verify the versions in running workloads. Updating a host’s libraries does not update copies bundled within container images.Disable Brotli decoding where patching is delayed. If immediate patching is not possible, disable Brotli decompression on vulnerable paths where supported, following vendor guidance and testing for application compatibility.Monitor for exploitation and post-exploitation behavior. Investigate the following: Unexpected process crashes in Node.js, Bun, Python, .NET, Envoy Proxy, or service mesh workloads.Repeated malformed Brotli payloads.Requests containing Content-Encoding: br to endpoints that normally do not receive compressed request bodies.Abnormal memory access violations or segmentation faults.Web server or application worker crashes after compressed request handling.Unexpected child processes spawned by web application runtimes.Unexpected outbound connections following crashes or the processing of malformed compressed input. Vulnerable VersionsThe following table lists vulnerable versions and corresponding fixes for selected software that incorporates the Brotli decoder. ProductVulnerable VersionsPatched VersionsGoogle Brotli1.0.3 < 1.0.10 (semver)1.0.10Google Brotli1.1.0 < 1.1.1 (semver)1.1.1Google Brotli1.2.0 < 1.2.1 (semver)1.2.1Node.js22.0.0 – 22.23.322.23.4Node.js24.0.0 – 24.22.024.22.1Node.js26.0.0 – 26.12.026.12.1Bun< 1.4.41.4.4.NET8.0.0 – 8.0.328.0.33.NET9.0.0 – 9.0.219.0.22.NET10.0.0 – 10.0.1310.0.14.NET11.0.0-preview.1 – 11.0.0-rc.211.0.0-rc.3.26522.148Python Brotli (PyPI)1.2.01.2.1Python brotlicffi (PyPI)1.2.0.0 – 1.2.0.21.2.1.0Envoy Proxy1.39.2, 1.38.5, 1.37.7, 1.36.111.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12Java brotli4j< 1.24.01.24.0libbrotli (Debian)1.1.0-21.1.0-2+deb13u1libbrotliVaries by distributionApply vendor security updatesTable 1: Software versions vulnerable to CVE-2026-111497 and the corresponding patched versions. ThreatLabz ObservationsThreatLabz observed reconnaissance and exploitation attempts involving CVE-2026-111497 through Zscaler Deception. Within the first 24 hours following public disclosure, Zscaler Deception’s global decoy mesh observed activity from 20 source IP addresses targeting 12 customers across 402 events. Of these events, 40% involved reconnaissance and 60% involved exploitation attempts. The table below summarizes the unique payloads associated with reconnaissance and exploitation attempts targeting CVE-2026-111497 observed through Zscaler Deception.Payload DescriptionJA4 FingerprintMalformed Brotli stream headers + valid Brotli differential check + Node.js path recont13d4312h1_c7886603b240_b26ce05bbdd6Truncated JSON Brotli + 8-byte invalid Brotli padding stream + uncompressed controlsNone22-byte & 23-byte invalid block-switch OOB-write seeds (CVE-2026-111497)t13d251100_b78ed14e2fd0_ab7e3b40a677Brotli decompression bomb / Celery stream probe + 1B controlsNoneAssetnote 1-byte malformed/valid Brotli differential checkMultiple observed3-stage Node2Shell capability, Strapi & CVE-2026-111497 JSON parser probet13d521100_b262b3658495_8e6e362c5eac14-byte Brotli {“ping”:1} differential sweept13d1714h1_ab0a1bf427ad_5e078a691127Table 2: Unique payloads observed during reconnaissance and exploitation attempts targeting CVE-2026-111497. How It WorksBrotli is a lossless compression algorithm and data format developed by Google. It is used for HTTP compression to reduce the size of web content such as HTML, CSS, JavaScript, JSON, and API responses. Brotli-encoded HTTP content is identified by the Content-Encoding: br header.Applications may use Brotli directly or through dependencies such as runtimes, frameworks, HTTP clients, and middleware. In some configurations, these components automatically decompress Brotli-encoded content without application code explicitly calling Brotli APIs.Vulnerability detailsThe flaw occurs in Brotli’s block-decoding logic. When a stream changes block type, the decoder determines the next block type and length. In vulnerable versions, there is a macro (in the fast-path logic) that does not properly check the return value of the DecodeBlockTypeAndLength function, which can cause the decoder to continue processing an invalid state (e.g., when provided a maliciously crafted Brotli stream). This can lead to an out-of-bounds write and be used as a primitive for RCE. The upstream fix modifies the decoder so malformed block-switch conditions return a distinct error that is propagated to the caller, stopping further decoding of the malicious Brotli stream.Attack chainExploitation of CVE-2026-111497 may follow either an inbound or outbound path, depending on where Brotli decompression occurs, as shown in the figure below. Inbound attempts use crafted Brotli-compressed HTTP request bodies while outbound attempts use crafted responses returned by an attacker-controlled or compromised server. These responses may be consumed through fetch(), webhook delivery, URL previews, crawlers or scrapers, and API integrations. In either path, exploitation requires attacker-controlled Brotli data to reach a vulnerable decoder, with compressed HTTP content marked by Content-Encoding: br. Figure 1: Potential inbound and outbound exploitation paths for CVE-2026-111497. ConclusionCVE-2026-111497 affects the Brotli decoder used by Node.js and other software. Exposure depends on whether an application passes attacker-controlled Brotli data to a vulnerable decoder. Organizations should identify vulnerable components and apply corresponding vendor updates, including updates for applications that bundle their own copy of Brotli.Zscaler Deception has observed active reconnaissance and exploitation attempts involving this vulnerability. ThreatLabz will continue monitoring for related activity and provide updates as additional findings become available. Zscaler CoverageZscaler Private Access (ZPA) App ProtectionThe following ZPA App Protection signature detects attempts to exploit CVE-2026-111497 in internal applications accessed through ZPA, including activity originating from compromised endpoints or insiders:App.Exploit.CVE-2026-111497Zscaler Deception Organizations should deploy the following Zscaler Deception decoys to help detect reconnaissance and exploitation attempts:MLflowMetaflowBento FrontendRay ServeGitLab How Zscaler Can HelpThe following table shows the typical attack stages and the mitigations recommended by Zscaler.Attack StageRecommended MitigationMinimize the external attack surfaceIdentify internet-facing applications containing vulnerable versions using Zscaler Exposure Management.Find services running vulnerable runtimes or libraries.Reduce direct exposure by placing applications behind a Zero Trust architecture.Prevent compromiseEnable SSL/TLS inspection where appropriate. Use Advanced Threat Protection to detect exploit attempts and suspicious payload delivery. Use ZPA App Protection to inspect and block suspicious requests targeting private applications. Reduce outbound exploitation riskRoute server egress through Zscaler Internet Access (ZIA) to inspect outbound traffic.Restrict application egress to approved destinations. Pay special attention to webhook, crawler, URL preview, and third-party integration services that fetch content from external or user-controlled URLs.Prevent lateral threat movementUse ZPA to enforce least-privilege user-to-application segmentation.Use Zscaler Deception to detect attacker movement after initial compromise. Monitor for suspicious access to internal applications following web application crashes or abnormal behavior.Detect post-exploitation activityUse Zscaler Managed Detection & Response (MDR) and Threat Hunting to investigate suspicious process behavior, command execution, unusual outbound connections, container runtime anomalies, and web application worker crashes.Prevent data lossInspect outbound traffic across channels with Zscaler Data Loss Prevention (DLP).Monitor for unusual uploads, archive transfers, credential exposure, or data movement following suspected exploitation. Indicators Of Compromise (IOCs)Source IP AddressActivity Type49.37.46.99Exploitation34.10.240.142Exploitation188.245.184.87Exploitation52.46.50.66Exploitation136.111.197.96Exploitation172.105.229.89Reconnaissance 49.36.35.148Reconnaissance 15.158.231.107Reconnaissance 172.235.194.230Reconnaissance 103.121.38.163Reconnaissance 213.136.92.88Reconnaissance 105.213.105.48Reconnaissance 172.105.95.212Reconnaissance 104.105.82.150Reconnaissance 172.233.109.39Reconnaissance 172.232.175.104Reconnaissance 3.172.4.141Reconnaissance 104.234.140.104Reconnaissance 104.234.140.110Reconnaissance 104.234.140.114Reconnaissance
