The Node2Shell Brotli flaw, tracked as CVE-2026-111497, is an out-of-bounds write in Google’s Brotli decoder now turning up in Visual Studio Code, Slack, Discord and common Python libraries, not only Node.js. Itnews reported that Electron apps carry their own browser-engine copies and rely on their own update mechanisms. Node.js disclosed the issue on October 21, 2026.
Key Takeaways
- CVE-2026-111497 is a CVSS 4.0 9.2 out-of-bounds write in Google’s Brotli decoder.
- VS Code, Slack, Discord, Signal, .NET and Python libraries ship private copies.
- PyPI Brotli 1.2.1 and brotlicffi 1.2.1.0 are silent security fixes.
- A February upstream fix stayed out of official Brotli releases until October.
The Node2Shell Brotli Flaw Lives in the Decoder
Most coverage framed Node2Shell as a Node.js bug. OpenSourceMalware’s write-up says the vulnerable code is Google’s Brotli C decoder, in c/dec/decode.c, and that Google assigned the CVE to github.com/google/brotli for versions 1.0.3 through 1.2.0. An invalid block-type switch can be treated like incomplete input, so the fast path keeps running and writes past a buffer.
Advisories pair CWE-252, an unchecked return value, with CWE-787, an out-of-bounds write. Reported effects are a crash, a memory leak, or potential remote code execution. The score is 9.2 on CVSS 4.0.
How Applications Reach the Bundled Decoder
Semgrep’s breakdown says the name overstates how automatically the bug fires. Node’s fetch() is exposed only when an application retrieves an attacker-controlled or attacker-influenced Brotli response. Express 5 using body-parser 2.x may decompress Content-Encoding: br bodies before JSON parsing when inflation is enabled and that parser is mounted.
Express 4 lacks that default path. OpenSourceMalware, not Semgrep, also names node:zlib as a route to the same decoder.
Patched Node.js releases are 22.23.4, 24.22.1, and 26.12.1. Itnews reported that the runtime’s advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the flaw, and Matteo Collina and Antoine du Hamel with the fix. OpenSourceMalware says Imperva disclosed the issue on October 21, that Imperva and others reproduced code execution against stock Node builds, and that Node had vendored the decoder into 20.x, 22.x, and 24.x before those lines were patched. The same account says Bun bundles the decoder too.
Electron Apps and Other Private Copies
McCarty investigated Python, Go, .NET, Perl and other ecosystems. Itnews reported that he said Chrome and Firefox updated their bundled Brotli. Electron apps do not inherit that browser fix. Signal, Slack, Discord and Visual Studio Code each carry a browser engine and their own updater.
.NET, DuckDB, Pillow and pyarrow also ship private decoders, while Envoy and Unity’s fork of the Mono runtime have been fixed, he said.
Itnews quoted McCarty, who calls the exposure the Brotlipocalypse:
“This vulnerability reminds us of that [Log4j] experience,” McCarty wrote. “We hope this isn’t going to be as disruptive, but the reality is that Brotli, like Log4j, is used everywhere.” “And, in our testing, its relatively easy to at least get denial of service, if not RCE,” he added.
| Component | Decoder copy | What sources say |
|---|---|---|
| Node.js | Bundled C decoder | 22.23.4, 24.22.1, 26.12.1 |
| Bun | Bundled decoder | OpenSourceMalware: Bun bundles it |
| PyPI Brotli | Compiles Google’s C decoder | 1.2.1 (22 Oct 2026); also 1.1.1, 1.0.10 |
| brotlicffi | Vendored C source | 1.2.1.0 (23 Oct 2026) |
| VS Code, Slack, Discord, Signal | Electron browser engine | Own updater; no shipped fix reported |
| .NET, DuckDB, Pillow, pyarrow | Own decoder copies | McCarty, via Itnews: each carries its own copy |
Quiet Fixes on PyPI After a February Patch
Two PyPI packages build from that C decoder: Google’s Brotli binding and brotlicffi, the CFFI alternative used on PyPy. OpenSourceMalware found the vulnerable pattern through Brotli 1.2.0 and said there is no safe older version to fall back to. Brotli 1.2.1, published October 22, 2026, is otherwise identical to 1.2.0.
brotlicffi 1.2.1.0 followed on October 23 with no release notes. Neither PyPI note mentions the CVE, even though Semgrep says the upstream 1.2.1 changelog does. OpenSourceMalware also lists fixes in Brotli 1.1.1 and 1.0.10.
On October 24, 2026, at 9am AEST, OpenSourceMalware said PyPI designated PYSEC-2026-4322 and PYSEC-2026-4323, and that GitHub advisory GHSA-9v8h-qqgm-4m35 now covers both packages. Before that, the post said scanners would not flag them.
The decoder fix was not new in October. Itnews reports that Google engineer Evgenii Kliuchnikov added it in February 2026, describing only a change to “detect and report invalid stream earlier,” with no mention of security. Because it was not in an official Brotli version until October, products built on unpatched libraries kept shipping the bug.
What Vendoring Means for Patch Queues
A Node.js upgrade does not update Visual Studio Code, Slack, Discord, Signal, .NET, DuckDB, Pillow, or pyarrow. That is a reading of these reports, not a new scan: each private copy is its own patch queue. Semgrep cites Rapid7 data putting recent high-severity exploitation at roughly three days in Q3 2026. OpenSourceMalware described a week that also included the LiteLLM supply-chain compromise.
- Move affected Node.js installs to 22.23.4, 24.22.1, or 26.12.1.
- Upgrade Python with pip install -U “Brotli>=1.2.1” “brotlicffi>=1.2.1.0”.
- Update Chrome and Firefox, then use each Electron app’s own update channel.
- Treat Envoy and Unity’s fork of the Mono runtime as fixed, per McCarty, and check .NET, DuckDB, Pillow, pyarrow, and Bun on their own.
