Node2Shell: Critical Google Brotli Vulnerability Could Allow Remote Code Execution Across Node.js, .NET And Other Platforms

A critical vulnerability in Google's Brotli compression library is creating a potentially wide-reaching security concern because the affected decoder is bundled into numerous popular development platforms and applications. The flaw, tracked as CVE-2026-111497 and known as Node2Shell, can potentially be exploited remotely without authentication when an application processes specially crafted Brotli-compressed data. The vulnerability carries a CVSS v4.0 score of 9.2, and successful exploitation could corrupt application memory, crash the affected process, disclose memory contents or ultimately lead to remote code execution. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue on 27 October 2026, making patching particularly important for organisations running affected software.

What makes Node2Shell especially significant is not simply the vulnerability itself, but how widely Brotli has been adopted. The compression library appears inside Node.js, Microsoft .NET, PowerShell 7, Visual Studio, Git for Windows, PHP Windows builds and several Python packages, meaning organisations may be exposed without deliberately installing Brotli as a standalone component. Developers may therefore need to look beyond obvious package inventories and check whether vulnerable Brotli versions are bundled inside runtimes, development tools, applications or container images.

What Is Brotli And Why Is It Everywhere?

Brotli is a compression algorithm originally developed by Google and widely used to reduce the size of web content and other data before transmission or storage. Modern browsers and web servers frequently use Brotli because it can achieve better compression than older methods in many scenarios, reducing bandwidth usage and improving delivery performance. Developers may encounter it through HTTP compression, application libraries or runtimes that include Brotli support automatically.

The problem with a vulnerability inside a widely embedded compression library is that the attack surface extends far beyond software carrying the Brotli name directly. An application may never advertise that it uses Brotli, yet its runtime or dependency chain may still contain the vulnerable decoder. This is why organisations need to identify not only standalone Brotli installations but also software platforms that bundle the affected code internally.

Node2Shell Is An Out-Of-Bounds Write Vulnerability

At the technical level, CVE-2026-111497 is an out-of-bounds write vulnerability inside the Brotli decoder. The problem occurs when the decoder receives a specially malformed Brotli stream containing an invalid block switch. Instead of treating that condition as a permanent format error and stopping processing, the decoder incorrectly interprets it as though additional input might resolve the problem.

The streaming decoder then continues adding input bytes to an internal buffer that is only eight bytes long. Eventually, data is written beyond the intended boundary of that buffer and into neighbouring process memory. Memory corruption of this kind can produce anything from a simple application crash to much more serious consequences if an attacker can manipulate what gets overwritten.

Remote Attackers May Not Need Authentication

One of the most concerning aspects of Node2Shell is that exploitation does not inherently require a valid account. If an attacker can supply crafted Brotli-compressed data to an application that automatically decompresses it, the vulnerable decoder may process the malicious stream before normal application-level authentication becomes relevant.

This means internet-facing applications that accept or retrieve Brotli-compressed content deserve particular attention. A service does not necessarily need to expose a feature labelled "Brotli" for the vulnerability to matter; it only needs a path where attacker-controlled compressed data reaches the vulnerable decoder.

Memory Corruption Could Lead To Remote Code Execution

An out-of-bounds write does not automatically guarantee code execution in every environment, but it provides attackers with a potentially powerful memory-corruption primitive. Depending on the application, operating system and runtime protections, exploitation could first result in a crash or process-memory disclosure before being developed into something more serious.

The advisory specifically identifies remote code execution as a possible impact. That is why the vulnerability has received a critical severity rating rather than being treated simply as a denial-of-service bug. Once arbitrary code is running inside an application process, the attacker may gain whatever permissions that process already possesses.

Node.js Is One Of The Most Important Affected Platforms

Node.js is particularly notable because Brotli support is built into its node:zlib module. The vulnerability affects the Brotli decoder included with Node.js 22.x, 24.x and 26.x, making the issue relevant to a substantial number of modern web services and backend applications.

Node.js applications frequently process HTTP traffic, APIs and external content, so organisations should identify which workloads actually make use of Brotli decompression and update the runtime regardless. Copies of Node.js bundled inside commercial applications, internal tools and containers are just as important as manually installed development environments.

Affected Node.js Versions And Required Updates

The corrected Node.js versions are straightforward, but organisations need to verify the actual runtime used by each application rather than simply checking what developers have installed locally.

Applications packaged with their own Node.js runtime may remain vulnerable even after the system-wide Node installation has been updated. Container images also need to be rebuilt using updated base images or corrected runtime packages rather than merely restarting an existing vulnerable container. 

Microsoft .NET Is Also Affected

Microsoft .NET applications can also be exposed to Node2Shell, although the vulnerability does not affect every .NET application automatically. The relevant exposure exists when software processes Brotli data through certain APIs, including ASP.NET Core request decompression, HttpClient automatic response decompression and System.IO.Compression Brotli functionality.

The first two capabilities are disabled by default, which reduces exposure for applications that never explicitly enabled them. However, software that directly uses Brotli APIs may still be vulnerable. Microsoft has also confirmed that the legacy .NET Framework included with Windows is not affected, which is an important distinction from modern .NET releases.

Affected .NET Releases Need Out-Of-Band Updates

Microsoft has issued out-of-band updates covering affected .NET runtimes and SDKs. The fixed releases are:

Administrators also need to restart affected applications after installing the updates. Another important detail is that Windows Update delivers these .NET fixes only when the option to receive updates for other Microsoft products through Microsoft Update is enabled, so organisations relying purely on default Windows patching behaviour should verify their update configuration.

Self-Contained .NET Applications Require Extra Attention

Self-contained and Native AOT .NET applications can be particularly easy to miss because the runtime may be bundled directly into the application. Updating the operating system or installing a newer shared .NET runtime does not automatically replace the version packaged inside those applications.

For these workloads, organisations need to install the latest corrected .NET SDK, rebuild the application and republish it. This is another example of why vulnerability management needs to understand how applications are packaged rather than assuming system-level updates automatically fix everything.

PowerShell 7 Has A More Direct Exposure Path

PowerShell 7 deserves attention because HttpClient automatic response decompression is enabled by default for commands such as Invoke-WebRequest and Invoke-RestMethod. These commands are widely used in administration scripts, automation, deployment pipelines and API integrations.

A PowerShell script that retrieves Brotli-compressed content from an attacker-controlled or compromised server could therefore encounter the vulnerable decoder automatically. Administrators may not have deliberately enabled Brotli anywhere in the script, yet the underlying HttpClient behaviour can still process the compressed response.

PowerShell 7 Should Be Updated Immediately

The fixed PowerShell releases are:

PowerShell applications and automation environments should also be restarted after the update. Organisations with scripts running through scheduled tasks, management servers or automation workers should ensure the corrected PowerShell runtime is actually being used by those processes.

Visual Studio And Git For Windows Are Also In Scope

Developers may be exposed through their workstation tooling as well. Visual Studio versions released before the 30 October 2026 update need to be upgraded through the Visual Studio Installer, while Git for Windows users should move to 2.56.0.windows.4 or later.

These products may not immediately appear related to a compression vulnerability, which demonstrates how deeply Brotli has become integrated into modern software ecosystems. Development machines should therefore be included in remediation rather than concentrating exclusively on production servers.

PHP On Windows Requires Checking The Build Number

PHP on Windows has an additional complication because the normal PHP version number alone may not reveal whether the corrected Brotli library is present. Specific refreshed Windows builds were released with Brotli 1.2.1 while retaining the same primary PHP release numbers.

The required patched builds are:

Administrators need to check the build suffix, not simply whether they are already running PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. A system using the original build without the updated Brotli component may remain vulnerable despite appearing to run the correct PHP release.

Python Brotli Packages Need Updating Too

Python environments may contain either the brotli or brotlicffi package. The corrected versions are brotli 1.2.1 and brotlicffi 1.2.1.0.

Python virtual environments can make remediation particularly complicated because each application may contain its own independent package set. Updating one system-wide installation does not necessarily update dozens of virtual environments embedded inside different applications. Organisations should therefore search application dependency files, package inventories and container images to identify vulnerable copies.

Google Brotli Itself Has Several Fixed Release Lines

For organisations using the Brotli library directly, the required fixed release depends on the branch already in use:

The important point is that organisations do not necessarily need to jump between major release lines. They can apply the appropriate corrected version for the branch they currently support.

The Full Affected-Product Picture

The vulnerability spans enough platforms that a consolidated view is useful:

This breadth is what makes Node2Shell more difficult than a vulnerability limited to one application. Security teams need to search across development environments, production systems, automation servers and application bundles rather than relying on a single patching workflow. 

Containers Are Easy To Forget

Containerised applications deserve special attention because vulnerable runtimes may exist inside an image even after the host operating system has been updated. A container based on an older Node.js, .NET, PHP or Python image will continue carrying its vulnerable dependencies until a new image is built.

Simply restarting an existing container does not solve this problem because it launches the same vulnerable image again. Organisations need to rebuild containers using the latest corrected base images and then redeploy them across the environment.

Container Registries May Contain Old Vulnerable Images

Even after production workloads are updated, container registries may still retain older images containing vulnerable Brotli versions. Those images can accidentally be redeployed later during rollback or disaster recovery.

Security teams should therefore identify and tag vulnerable historical images rather than assuming current production versions are the only concern. Software composition analysis and container scanning can help find vulnerable packages inside images before they are deployed.

Internet-Facing Systems Should Be Prioritised

The advisory recommends prioritising systems that are accessible from the internet because remote attackers need a path to provide crafted Brotli-compressed data. Web servers, APIs and services that automatically retrieve external content deserve particularly close attention.

However, internal applications should not be ignored indefinitely. An attacker who already compromises another part of the network may still be able to reach internal vulnerable services, so exposure should influence patching priority rather than determine whether systems are patched at all.

Azure Services Operated By Microsoft Are Being Addressed Separately

Microsoft has said it has patched or is in the process of patching services that it manages directly, including Microsoft 365, Azure App Service, Azure Functions and Azure Kubernetes Service. Customers generally do not need to manually patch the Microsoft-controlled infrastructure behind those managed services.

The situation changes for customer-managed workloads running on top of Azure. Applications, virtual machines, custom containers and runtimes installed by customers remain the customer's responsibility and need to be updated independently.

Customer-Managed Software Still Needs Customer Action

This distinction is particularly important in cloud environments because organisations sometimes assume the provider patches everything automatically. Managed platform components may be updated by Microsoft, but software that the organisation installs or bundles itself still belongs to the customer's patching responsibility.

Node.js runtimes, PowerShell 7 installations, .NET applications, Git for Windows, Visual Studio and container images all need to be reviewed according to how they are deployed. The cloud does not remove patch management; it simply changes which layer belongs to which party.

Azure WAF Can Provide Additional Protection

Organisations using Azure Application Gateway, Azure Front Door Premium or Azure Web Application Firewall can apply Default Rule Set 2.2 or Microsoft's relevant custom rule as an additional mitigation. This can provide another layer of protection while applications are being updated.

However, the advisory makes an important limitation clear: Azure WAF inspects inbound requests only. If an application itself connects to another server and automatically decompresses a malicious Brotli response, the WAF does not protect that outbound-response path. 

A WAF Is Therefore Not A Replacement For Patching

This is a common misunderstanding with web application firewalls. A WAF can block certain malicious request patterns before they reach the application, but it cannot necessarily protect every internal library or every data flow.

Node2Shell can be triggered through situations where the application retrieves compressed content itself, particularly with functionality such as automatic HttpClient decompression. Only replacing the vulnerable Brotli decoder removes the underlying bug completely.

The Vulnerability Is Already In CISA's KEV Catalogue

CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Inclusion in the KEV catalogue is significant because it indicates the vulnerability is not being treated merely as a theoretical research finding.

For organisations, that should increase remediation priority. Once attackers are known to be exploiting a vulnerability, patch windows measured in weeks or months become much harder to justify for exposed systems.

Patch Availability Does Not Automatically Mean Safety

Google, Microsoft and Node.js have already released fixes, but a vulnerability remains dangerous until those updates actually reach every affected installation. Large environments can contain multiple copies of the same runtime spread across servers, developer machines, containers and bundled applications.

An organisation may therefore believe it has patched Node.js while an internal product still ships its own vulnerable Node executable. Comprehensive asset discovery is just as important as installing the update itself.

Software Inventories Need To Include Embedded Runtimes

Traditional asset-management systems often identify installed applications but may miss runtime components bundled inside commercial products. Node.js and Python environments are frequently packaged directly inside applications, while container images may contain several dependencies hidden from ordinary operating-system inventory tools.

Software composition analysis can help identify those embedded components. Development teams may also need to review build manifests, package lock files and container definitions rather than relying entirely on central IT inventories.

Developers Should Rebuild Applications Where Necessary

For some platforms, simply replacing a runtime package is sufficient. For others, particularly self-contained .NET applications and containers, the application itself needs to be rebuilt so the corrected library becomes part of the deployed package.

This means remediation may require developer involvement rather than being handled entirely by infrastructure teams. Coordinating security, development and operations becomes especially important when a shared library vulnerability crosses many different software stacks.

Restarts Are Part Of The Remediation

The advisory also notes that Microsoft's out-of-band fixes require an additional restart. This matters because installing corrected files does not necessarily replace code already loaded into a running process.

Applications and services need to restart so the updated runtime or library is actually used. Administrators should therefore verify both installation status and service restart completion rather than considering the patch finished once the package manager reports success.

Security Teams Should Verify Rather Than Assume

After patching, organisations should confirm the actual runtime versions being used by production processes. This can involve checking application logs, command-line version output, package inventories and container manifests.

Verification becomes particularly important when several development teams independently deploy software. A central patching team may update the base server while an application continues loading its own outdated copy of Brotli from a local directory.

Node2Shell Shows The Risk Of Shared Dependencies

Modern software development depends heavily on reusable libraries because rebuilding compression, cryptography, networking and other complex functionality from scratch would be inefficient and dangerous. The trade-off is that one vulnerability in a widely adopted dependency can suddenly affect many unrelated products.

Node2Shell demonstrates this perfectly. Node.js, .NET, PowerShell, PHP, Python and development tooling appear unrelated at first glance, yet all can ultimately depend on the same Brotli decoder implementation.

One Library Can Create A Huge Patch Surface

The number of affected applications matters because remediation effort grows rapidly when a vulnerable component appears across many platforms. Security teams need to coordinate patches from different vendors, each using its own version numbering and release schedule.

The challenge becomes even greater when the same company uses several affected platforms simultaneously. A typical enterprise might have Node.js APIs, .NET business systems, PowerShell automation, Visual Studio development machines and Python scripts all requiring separate action.

Dependency Management Is Becoming A Security Discipline

Vulnerabilities such as Node2Shell reinforce why organisations need visibility into the third-party components used by their software. Knowing an application is written in Node.js or .NET is no longer enough; teams also need to understand which lower-level libraries those runtimes incorporate.

Software bills of materials can help by documenting the components included within applications. When a shared dependency vulnerability appears, organisations can then search their inventory instead of beginning an emergency manual investigation from scratch.

Developers Should Avoid Assuming Their Application Is Too Simple To Be Affected

A small application may still be vulnerable if it automatically processes Brotli data through an affected runtime. Complexity does not necessarily determine exposure.

A simple PowerShell script calling Invoke-WebRequest against an external service may interact with the vulnerable decompression path just as easily as a much larger web application. Exposure depends on how the software handles compressed data rather than how sophisticated the application appears.

Remote Code Execution Makes This More Than A Stability Bug

The possibility of application crashes might initially make Node2Shell sound like a reliability issue, but memory corruption changes the risk substantially. Attackers who can control overwritten memory may be able to turn the flaw into execution of their own code.

That potential is what separates a critical security vulnerability from an ordinary malformed-input crash. Organisations should therefore not accept repeated application crashes as the only likely impact when the advisory explicitly identifies remote code execution as possible.

Final Thoughts

Node2Shell, tracked as CVE-2026-111497, is a critical Brotli decoder vulnerability with a CVSS score of 9.2 that can potentially be exploited remotely without authentication. A crafted Brotli stream can trigger an out-of-bounds write in the decoder, corrupting application memory and potentially resulting in crashes, memory disclosure or remote code execution.

The biggest challenge is its reach. Brotli is embedded across Node.js, .NET, PowerShell 7, Visual Studio, Git for Windows, PHP Windows builds, Python packages and countless applications and container images built on top of those platforms. CISA's decision to add the vulnerability to its Known Exploited Vulnerabilities catalogue further increases the urgency.

Organisations should inventory every system and application capable of processing Brotli data, prioritise internet-facing workloads and install the appropriate corrected versions. Node.js, .NET, PowerShell and Visual Studio environments need vendor updates, PHP Windows users need the refreshed build numbers, Python environments need updated packages and containers should be rebuilt using current base images.

Azure WAF protections can provide another defensive layer for inbound traffic, but they do not remove the underlying vulnerability and do not protect applications that retrieve malicious Brotli responses themselves.

The broader lesson is familiar but important: a vulnerability does not need to exist inside your own application code to become your problem. When one widely used library sits underneath half your development stack, one flaw can suddenly become an organisation-wide patching exercise.