Node2Shell: Memory Corruption RCE in Brotli Affecting Node.js

I recently published a proof of concept for CVE-2026-111497 , which I’ve been calling Node2Shell .

The issue is a memory-corruption vulnerability in brotli 1.2.0 that affects Node.js releases bundling the vulnerable decoder.

The interesting part is that this is not an application-level eval() , execSync() , child-process misuse, or webhook trick.

The vulnerability exists lower in the stack, inside the Brotli decoder itself.

Under the right conditions, corrupted decoder state can eventually redirect execution through a callback path and reach system() .

Affected Node.js Versions

According to the affected ranges identified during testing:

Node.js 22.x before 22.23.4

Node.js 24.x before 24.22.1

Node.js 26.x before 26.12.1

The underlying issue originates in the bundled Brotli implementation.

Root Cause

One part of the problem is located around DecodeBlockTypeAndLength() .

Under specific decoder state conditions, the function…