Disclosure: this post was drafted with AI assistance and reviewed by ShrineTech. The header image was generated with Krea 2. Defensive guidance only. It contains no exploit details. Facts were checked against the vendor and government sources listed at the end on 2026-10-31. Status changes quickly, so check them again.

What it is

Brotli is a compression format. Google's reference decoder, which Node.js bundles, has a flaw in c/dec/decode.c. According to the NVD record, a crafted Brotli stream can corrupt decoder memory, leak memory contents, crash the process, or possibly allow code execution. The weakness is filed as CWE-252 (unchecked return value) and CWE-787 (out-of-bounds write). The Node.js advisory describes the trigger as an invalid block switch that the decoder treats as "need more input", so it keeps writing past an 8-byte buffer.

It is being exploited. CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-10-27 (federal due date 2026-11-10), and its own assessment lists exploitation as "active". NVD gives it CVSS 3.1 9.8 (NVD) and CVSS 4.0 9.2 (Google, as secondary source).

Names you may see in coverage ("HTTP2Shell", "Node2Shell") are nicknames from third parties. None of the vendor or government pages we read uses them, so we do not rely on them.

Who is affected

Per the NVD configuration data, which agrees with the Node.js advisory:

The same record also lists Envoy, Istio, DuckDB, ClickHouse, Apache Arrow, p7zip, woff2 and several Siemens products. Check any of those you run.

The Node.js page lists the High-severity issue for 22.x, 24.x and 26.x. It does not map each CVE to a fixed version, and it states no workaround. The versions in the table above come from NVD.

The Python PyPI package Brotli also has a 1.2.1 release, and Google's 1.2.1 release notes list this CVE under Security.

Why "update Node" is not enough

The common failure is a service that still runs an old runtime. Version managers (mise, nvm, asdf), pm2 and systemd units often pin an absolute path such as /path/to/version-manager/installs/node/<old-version>/bin/node. Upgrading "Node" on your PATH leaves those untouched. Running processes also keep the old runtime until restarted. In our own sweep the stragglers were exactly these: a few background services on an older 24.x line after the main runtimes had been patched.

What to do now

1. Inventory every Node runtime that is actually running.
   Copy

   for p in $(pgrep -x node); do
     printf '%s  %s  %s\n' "$p" "$(readlink /proc/$p/exe)" "$(tr '\0' ' ' < /proc/$p/cmdline | cut -c1-80)"
   done
   

   Then run each distinct binary with --version. Compare to 22.23.4, 24.22.1 or 26.12.1 (or newer in the same line).
2. Check units and managers. systemctl cat <unit> | grep ExecStart (and systemctl --user), pm2 jlist | grep -i exec_interpreter, and mise ls node or nvm ls.
3. Upgrade Node to a fixed release in your line, then update the ExecStart paths that pin an older install. Node 22, 24 and 26 are the lines the advisory covers. Older lines (Debian still ships 18 and 20) are listed as vulnerable in Debian's tracker with no fix when we checked, so move off them or use the stopgap in step 8.
4. Python. In every virtualenv: pip list 2>/dev/null | grep -i -E '^brotli', covering Brotli and brotlicffi. Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 or newer. Docker images and CI caches carry their own copies.
5. System library. apt policy libbrotli1.
   • Ubuntu: fixed packages are published for all supported releases (for example 24.04 1.1.0-2ubuntu0.1, 22.04 1.0.9-2ubuntu0.1, 26.04 1.2.0-3ubuntu0.1), through USN-8956-1 (2026-10-26) and USN-8956-2 (2026-10-27). Run sudo apt update && sudo apt install --only-upgrade libbrotli1. If you put the package on hold as a stopgap, remove the hold first (sudo apt-mark unhold libbrotli1).
   • Debian: bookworm 1.0.9-2+deb12u1 (DLA-4855-1), trixie 1.1.0-2+deb13u1 (DSA-6582-1).
6. Other runtimes and embedded copies: update Bun to 1.4.4 or newer, .NET to the patched servicing release, and check desktop apps and CLIs that embed a runtime or a Brotli library.
7. Restart everything you changed.
8. Until you are patched: avoid decompressing Brotli from sources you do not control. For curl, skip --compressed on such URLs. Treat this as a stopgap. It does not replace patching.

Prioritise by exposure. Because it is being exploited, put internet-facing services first: API gateways, proxies, scrapers that fetch arbitrary pages, and anything that calls Brotli decompression on outside data. A service that only listens on localhost and never decompresses outside data is lower risk, but still patch it.

If you ran an exposed, unpatched service over the last week, CISA's required action also points to its forensics triage guidance. Read it, and check your logs for unusual crashes of Node processes.

How to verify

• Re-run the step 1 loop after the restart. Every readlink target should be a fixed version.
• node -e "console.log(process.version)" using each pinned binary path.
• apt policy libbrotli1 shows the installed version equal to the candidate. apt changelog libbrotli1 | grep -i 111497 should list the CVE.
• Per virtualenv: python -c "import brotli; print(brotli.__version__)".
• Re-scan your container images with your usual scanner.

Quick answers

Is CVE-2026-111497 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-10-27 and lists exploitation as active. Its federal due date is 2026-11-10.

Which Node.js versions fix CVE-2026-111497?

22.23.4, 24.22.1 and 26.12.1, according to NVD's configuration data. Anything older in those lines is affected.

Do I need to patch Python and system packages too?

Check them, yes. The Python brotlicffi package is fixed in 1.2.1.0 and Brotli has a 1.2.1 release. On Ubuntu and Debian, update libbrotli1. Docker images and CI caches carry their own copies.

I updated Node. Why might I still be vulnerable?

Services often pin an older runtime by absolute path (version managers, pm2, systemd), and running processes keep the old runtime until restarted. List the binaries your processes actually use and restart them.

Related in this series: hardening your tailnet; the Linux TCP and Chrome CVE guide; the egress-audit method.

Sources

• Node.js security releases, 2026-10-21: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• NVD (analysed; CVSS, CISA fields, affected versions): https://nvd.nist.gov/vuln/detail/CVE-2026-111497
• CISA Known Exploited Vulnerabilities catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
• Google Brotli 1.2.1 release notes: https://github.com/google/brotli/releases/tag/v1.2.1
• Ubuntu CVE tracker: https://ubuntu.com/security/CVE-2026-111497
• Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-111497

---