Executive Summary

BGD e-GOV CIRT alerts government agencies, critical infrastructure operators, financial institutions, telecommunications providers, software developers, hosting providers and other organizations to a critical vulnerability in the Brotli decompression library, tracked as CVE-2026-111497.

The vulnerability, commonly referred to as Node2Shell, is an out-of-bounds write in the Brotli decoder. A carefully malformed Brotli-compressed data stream can trigger an invalid memory write during decompression. Depending on the affected application and runtime environment, successful exploitation may result in process crashes, disclosure of process memory or remote code execution (RCE).

The vulnerability affects Node.js applications that use the vulnerable decoder and may also affect other software incorporating vulnerable Brotli implementations. Applications can be exposed when they decompress untrusted data through direct library calls, HTTP response processing or request-body parsing.

Public threat intelligence reporting indicates that exploitation is occurring in the wild. The vulnerability was also reported as added to the Known Exploited Vulnerabilities (KEV) catalogue on 27 October 2026. Organizations should therefore prioritize asset discovery, vulnerability assessment and deployment of the appropriate security updates.

The vulnerability is not restricted to servers. Applications that retrieve and automatically decompress untrusted HTTP responses may also be at risk. Exposure depends on the vulnerable component, the installed version, the data-processing path and whether attacker-controlled Brotli data can reach the decoder.

Immediate action: Identify vulnerable Node.js and Brotli deployments, upgrade to verified fixed releases or patched vendor packages, review other products incorporating Brotli, and investigate suspicious activity involving affected applications.

Vulnerability Overview

Brotli is a lossless compression algorithm used to reduce the size of data transmitted over networks and stored by applications. It is commonly associated with HTTP content encoding through the br encoding token.

CVE-2026-111497 affects the Brotli decoder's handling of malformed block-switch information in a compressed stream. The decoder may incorrectly interpret an invalid condition as a temporary shortage of input instead of rejecting the malformed stream.

As a result, the streaming decoder can continue appending data beyond the intended boundary of an internal buffer. This out-of-bounds write can corrupt adjacent process memory.

The vulnerability has been described under several names:

·   Node2Shell: Commonly used in reporting focused on Node.js.

·   Broccoli2Shell: Used in reporting about the broader Brotli vulnerability.

·   HTTP2Shell: Another name appearing in public reporting.

These names refer to the same CVE in the sources reviewed; they should not be treated as separate vulnerabilities without additional evidence.

Technical Analysis

Root cause

The vulnerability occurs in the Brotli decoder's block-type switch handling.

During decompression, the decoder processes a structured stream containing information about compressed data blocks. A malformed stream can signal an invalid block-type transition.

The vulnerable decoder incorrectly treats the invalid condition as though additional input might resolve it. In the streaming path, further bytes are appended to an internal buffer that has a fixed boundary.

The decoder subsequently writes beyond the intended buffer boundary, potentially corrupting memory belonging to the running process.

The technical issue can be summarized as:

·  The application receives attacker-controlled Brotli-compressed data.

·  The data reaches the vulnerable decoder.

·  The stream contains an invalid block-switch condition.

·  The decoder fails to reject the malformed condition correctly.

·  Processing continues and causes an out-of-bounds write.

·  The affected process may crash or experience memory corruption, with possible information disclosure or code execution.

This sequence describes the reported vulnerability mechanism. It does not mean that every malformed stream will produce reliable code execution.

Why the decoder's error handling matters

A decompression implementation must distinguish between incomplete input and structurally invalid input.

An incomplete stream may legitimately require more bytes before decoding can continue. A malformed stream, however, must be rejected when its structure is invalid.

In the vulnerable implementation, a particular invalid block-switch condition is treated as a request for more input. This allows the streaming decoder to continue processing when it should instead return a format error.

The upstream correction makes the decoder reject the invalid block-switch condition rather than treating it as incomplete input.

Full Details Below...