Node2Shell (CVE-2026-111497), also called HTTP2Shell and Broccoli2Shell, is a critical flaw in Google’s Brotli decoder that can enable remote code execution when software decompresses attacker-controlled data.

The bug affects Brotli versions 1.0.3 through 1.2.0: an invalid block switch is mistaken for a request for more input, allowing attacker-supplied bytes to overflow an eight-byte internal buffer; exploitation needs no authentication or user interaction, but the target must decompress malicious data.

Google and the Node.js project disclosed the vulnerability on October 21, 2026, and Google assigned it a CVSS 4.0 score of 9.2; ELLIO reported exploit traffic on October 26, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the following day.

Affected software includes Node.js, .NET, Bun, Envoy, Istio, Python Brotli packages and other products that embed the decoder, so updating a system-level Brotli package may not fix vulnerable copies bundled in runtimes, containers or compiled applications.

A successful attack can give an attacker a shell with the service account’s permissions, exposing secrets and cloud credentials and enabling lateral movement, tool downloads, cryptomining or ransomware; crashes and automatic restarts may be followed by repeated attempts.

The recommended fix is to upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, or install the relevant patched releases for other affected products; Node.js 20, 23 and 25 are end of life and will not receive fixes, and organizations should rebuild container images and compiled executables to replace embedded vulnerable copies.

If patching is delayed, organizations can reject inbound requests with `Content-Encoding: br`, but that does not protect against malicious Brotli responses fetched server-side and is not a complete workaround; monitoring should cover crashes, restart loops, high CPU use during decompression, unexpected shell spawning or outbound connections, and `Content-Encoding` headers.

SafeBreach added simulation #11843, which sends a crafted Brotli request over HTTP or HTTPS to check whether defenses detect or block it before it reaches a vulnerable Node.js service; it is an exposure check, not an exploit, and does not execute code or open a shell.

SafeBreach also points to generic post-exploitation simulations for behaviors such as web-shell deployment and rogue certificate authority installation, as well as testing through its Node2Shell scenarios or Known Threats Series report.