Is Your Node.js Version Vulnerable to the Brotli RCE? Check in 2 Minutes

Run this now. If your version sits below the floor in the table, the Node.js Brotli RCE (CVE-2026-111497) applies to you, and attackers are already using it.

node -v

For a second signal, ask the binary directly:

node -p "require('node:zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"

The fix added this constant. We ran it on nine official macOS builds from the three supported lines: every fixed build printed -17, and every older build printed undefined. Trust node -v first, because a distro that backports the patch may not add the constant.

Skip process.versions.brotli. It printed 1.2.0 on both 24.21.0 and 24.22.1, and 1.1.0 on both 22.23.3 and 22.23.4. Node.js cherry-picked the fix without changing the reported version, so this field can’t tell you whether you’re patched.

TL;DR

ELLIO reported exploit traffic in its sensors by October 26, five days after the fix. The payload it captured targeted Node.js 24.22.0 on x86-64. That payload’s final stage failed in ELLIO’s tests, but ELLIO also confirmed code execution itself on stock 24.22.0 builds. CISA gave US federal agencies until November 10 to act, and it marks ransomware use as “Unknown”. Akamai’s telemetry showed 61% of networks running affected versions on October 26.

Node2Shell explained: what the Brotli bug does

Node2Shell is an out-of-bounds write in the Brotli decoder that ships inside the Node.js runtime. A malformed compressed stream makes the decoder write past the end of an eight-byte internal buffer, which corrupts process memory. The result can be a crash, leaked memory, or attacker-controlled code running on your server.

The root cause is a misclassified error. An invalid block switch came back as “I need more input” instead of “this data is broken”, so the streaming decoder kept appending bytes to that small buffer.

The bug lives in Google’s Brotli library, versions 1.0.3 through 1.2.0, so it isn’t only a Node.js problem. Node.js fixed its copy by cherry-picking upstream commit 0ed4268a into the 24.22.1 release and its siblings. OpenAI Codex Security researchers Khai Tran and Sylvie Mayer reported it.

Your dependency scanner won’t catch this, because the decoder ships in the runtime, not a package. npm install reported 0 vulnerabilities for our Express 5 test project while running on an unpatched Node.js 24.15.0.

Who is reachable

A vulnerable runtime is half the condition. The other half is a path that feeds untrusted Brotli data to the decoder. We tested each path on Node.js 24.22.1 by sending a harmless invalid body (the text not-valid-brotli) with Content-Encoding: br, and by serving valid Brotli to each client.

Two results deserve a second look. fetch() decoded Brotli even when the request sent Accept-Encoding: identity, because it follows the response header, not what you asked for. Any server your app calls can reach the decoder, so a webhook tester, link previewer or URL importer is exposed. And a 400 alone proves nothing: Express 5 and plain Fastify both return one, but only Express 5 ran the decoder. Read the error message.

Find your paths with three commands:

# Direct decoder use
grep -rnE "brotliDecompress|createBrotliDecompress" src/

# Parsers that decode request bodies
npm ls express body-parser @koa/bodyparser @fastify/compress

# Base images and pinned versions
grep -rnE "^FROM .*node" --include='Dockerfile*' .

One new fetch() call changes these answers, so “not reachable” still means patch.

How to patch CVE-2026-111497

Go to the latest build on your line, not the floor. These sources all carried fixed builds on November 5:

Then close the two gaps that catch people out:

• Restart everything. A running process keeps the old binary in memory, so upgrading on disk changes nothing until pm2, systemd or your orchestrator restarts it.
• Rebuild what you shipped. Old images keep the old runtime, and images pinned by digest need an image scan because the tag won’t tell you.

Finish by running the checks at the top of this post inside the deployed container, then on CI runners and developer machines. To see the newest security build per line:

curl -s https://nodejs.org/dist/index.json | jq -r '[.[] | select(.security == true and (.version | test("^v(22|24|26)\\.")))] | group_by(.version | split(".")[0]) | .[] | max_by(.date) | "\(.version)  \(.date)"'

Still on 20 or 25? No build exists for you. Read the Node.js 20 End-of-Life plan and move.

Node.js Brotli mitigations if you can’t patch today

These buy time. None replaces the upgrade.

1. Reject br at the edge. Block Content-Encoding: br at your proxy or load balancer, matching case-insensitively and inside lists like gzip, br.
2. Reject it in the app. Put this before your body parsers. It returned 415 in our Express 5 test:

app.use((req, res, next) => {
  const encoding = req.headers['content-encoding'] || '';
  if (/\bbr\b/i.test(encoding)) return res.status(415).end();
  next();
});

3. Turn off inflation. express.json({ inflate: false }) returned 415 for the same request. It rejects gzip bodies too, so check your clients first.
4. Control outbound responses. axios accepts decompress: false, which left the bytes undecoded in our test. fetch() has no standard off switch, so restrict which hosts it can reach with an allowlist and egress rules.
5. Limit the blast radius. Segment Node.js services, and restrict who can read core dumps, since ELLIO notes crashes can expose in-memory data there.

Watch for what ELLIO saw first: bursts of Brotli-encoded request bodies mapping which hosts decode them. Unexpected Content-Encoding: br traffic on a JSON API, or a spike in worker crashes, is worth an investigation.

Prove your API survived the upgrade: let your agent run it

A runtime jump can change TLS, DNS and HTTP behavior, and October’s release touched all three. Don’t diff that by hand. Let your coding agent run Apidog CLI before and after, then report what moved.

npm install -g apidog-cli@latest
apidog login --with-token <YOUR_TOKEN>
npx -y skills add https://apidog.com   # pick your agent when prompted

Give your agent one prompt:

Run Apidog test suite <id> in project <id> against staging and save the
results to reports/before. After I upgrade Node.js, add a test case for
POST /orders that sends the plain text "not-valid-brotli" with
Content-Encoding: br, asserts a 4xx status, then checks GET /health
returns 200. Rerun the suite to reports/after and list every request
whose result changed.

The agent runs these commands:

apidog run --test-suite <id> --project <id> -e <envId> -r cli,junit --out-dir reports/before
apidog cli-schema get test-case-create
apidog cli-schema validate test-case-create --file case.json
apidog test-case create --project <id> --file case.json
apidog run --test-case <caseId> --project <id> -e <envId> -r cli,json
apidog run --test-suite <id> --project <id> -e <envId> -r cli,junit --out-dir reports/after

That extra case is a health check, not an exploit: the body is plain text, and it failed with the same padding error on vulnerable and fixed builds in our test. It catches a real gap, though. Our Koa test answered 500 because the decode error went unhandled, and a public API should answer 4xx. Run it against staging only.

The run command reference lists every flag, and the CI/CD guide puts the same JUnit run in your pipeline. Apidog’s Free plan covers up to 4 users.

Why November 11 matters next

The Node.js project has pre-announced another release for 26.x, 24.x and 22.x on or shortly after November 11, 2026, again with HIGH as the top severity. No CVEs are public yet. Our November release guide covers how to prepare.

Patch Brotli now rather than folding it into that window. The bug has public details and live traffic today, and the upgrade you run this week rehearses the next one: same inventory, same image rebuilds, same test suite. PHP2Shell and React2Shell moved the same way.

FAQ

Is CVE-2026-111497 being exploited? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on October 27, 2026, under Google Brotli, and ELLIO recorded exploit traffic by October 26.

Is it high or critical? Both labels are real. Node.js rates it HIGH. NVD scores it 9.8 CRITICAL on CVSS 3.1, and the Google-issued CVSS 4.0 score is 9.2. Plan around the fact that it’s exploited.

I’m on Express 4. Am I safe? Your request bodies don’t reach the decoder, but fetch(), axios and direct node:zlib calls still do. The same release also fixed nine other CVEs, so upgrade anyway.

Is Node.js 20 affected? The project doesn’t assess End-of-Life lines, and they get no fix. Treat 20.x and 25.x as unpatched and unassessed, then migrate.

Does this affect anything besides Node.js? Yes. The GitHub advisory covers the PyPI brotli and brotlicffi packages, and vendors report fixes for Bun 1.4.4 and .NET. Update each decoder separately, because a Node.js upgrade only covers its own copy.