Brotli2Shell: Brotli decoder remote code execution (CVE-2026-111497)
The Brotli decoder in Node.js, .NET and Python allows code execution via crafted compressed streams. Active exploitation observed; CISA due date Nov. 10.
Who is affected
- Node.js 22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1; end-of-life lines 20.x, 23.x and 25.x will not receive a fix
- Booking engines and guest portals built on Express 5 (5.0.0 to 5.3.0) or body-parser 2.0.0 to 2.3.0, which decompress Brotli request bodies automatically
- .NET, PowerShell and Visual Studio (Microsoft advisory of Oct. 25), Python HTTP clients brotli and brotlicffi, Bun, Envoy Proxy, Istio, PHP for Windows
- Hospitality SaaS shipping Node.js or the Brotli library: booking engines, chatbots, channel managers, integration gateways
How to fix
Update Node.js to 22.23.4, 24.22.1 or 26.12.1 and rebuild container images: Imperva's exploit demonstration runs against the official, unmodified Node.js 24.22.0 image. Update .NET and PowerShell per Microsoft's Oct. 25 advisory, and the Python brotli (1.0.10, 1.1.1 or 1.2.1) and brotlicffi packages. Ask every SaaS vendor in writing (booking engine, chatbot, channel manager) for the exact runtime version deployed. Until patched, block or disable Content-Encoding: br upstream of client-facing entry points (WAF, CDN, reverse proxy).
What happened
CVE-2026-111497 is an out-of-bounds write in the C decoder of Brotli, Google's compression library embedded by Node.js, .NET and many others. A purpose-built compressed stream corrupts decoder memory: crash, process memory disclosure, or remote code execution. Node.js shipped fixes on Oct. 21. Google, as CNA, scores the flaw 9.2 under CVSS v4.0; NVD scores it 9.8 under CVSS 3.1. CISA added it to the KEV catalog on Oct. 27 with a remediation due date of Nov. 10.
Imperva's Red Team demonstrated code execution against the official Node.js 24.22.0 image, no debugger or instrumented build needed, through two paths: a compressed response consumed by the native fetch(), and an inbound request body decompressed by Express or body-parser. The fixed 24.22.1 rejects the same input. Threat-intelligence firm ELLIO observed exploit traffic on Oct. 25 and 26; those attempts crashed the target process without reaching code execution, which researchers describe as first-generation.
Why it matters for a hotel
Hospitality's web estate is heavily Node.js: booking engines, guest portals, chatbots, integration gateways. Express 5 decompresses Brotli request bodies by default, so the attack surface does not require an application bug: an attacker only needs to send a request. The outbound path is subtler: any service calling a third-party API with the native fetch() decodes that partner's compressed response. A compromised partner platform becomes a delivery vector.
Who is affected
- Node.js before 22.23.4, 24.22.1 or 26.12.1, including unrebuilded official container images. The 20.x, 23.x and 25.x lines are end of life and will not be fixed.
- Any application decompressing third-party Brotli data: .NET and PowerShell (Microsoft fixes of Oct. 25), Python brotli and brotlicffi clients, Bun, Envoy Proxy, Istio, PHP for Windows.
- Every product bundling its own copy of Brotli needs its own fix: hospitality SaaS case by case.
How to fix
- Update Node.js to 22.23.4, 24.22.1 or 26.12.1, then rebuild container images and redeploy.
- Update .NET, PowerShell and Visual Studio per Microsoft's Oct. 25 advisory.
- Update the Python brotli (1.0.10, 1.1.1 or 1.2.1) and brotlicffi packages.
- Ask each SaaS vendor (booking engine, chatbot, channel manager) for the exact runtime version, and keep the answer on file.
- Until patched: disable or filter Content-Encoding: br at the WAF, CDN or reverse proxy in front of client-facing entry points.
Context
The decoder fix was committed to google/brotli on Feb. 27, 2026 without a release or advisory and stayed publicly readable for eight months before the releases of the week of Oct. 20. The competing names (Node2Shell, HTTP2Shell, Broccoli2Shell) all describe the same flaw; the only common denominator is the Brotli decoder itself, hence the name used here.