Hello, this is Sparrow.
A security vulnerability (CVE-2026-111497) has recently been disclosed in Node.js that may lead to denial of service, disclosure of information in process memory, or remote code execution (RCE).
Known as “Node2Shell,” this is an out-of-bounds write vulnerability that occurs when the Brotli library bundled with Node.js decompresses malformed compressed data and writes beyond the bounds of its internal buffer.
Exploitation of this vulnerability may result in denial of service, in-memory information disclosure, and remote code execution. Prompt inspection of affected versions and application of security updates are strongly recommended.
■ Overview
- CVE ID: CVE-2026-111497
- Severity: HIGH – official Node.js rating. “Brotli decoder out-of-bounds write permits remote code execution”
- Key risks: Denial of service, disclosure of information in process memory, and remote code execution (RCE)
- Affected versions and patched versions
Product Name Affected Versions Patched Versions Node.js Below 22.23.4 22.23.4 or Later Node.js Below 24.22.1 24.22.1 or Later Node.js Below 26.12.1 26.12.1 or Later ※ Versions that have reached end of life (Node.js 20.x and earlier, as well as 23.x, 25.x, etc.) do not receive security updates. We recommend upgrading to a supported version.
■ Impact and Attack Conditions
This vulnerability occurs when the Brotli library bundled with Node.js writes data beyond the allowed range of its internal buffer while decompressing malformed compressed data.
If an attacker delivers crafted Brotli-compressed data to an application, and the application processes it using the vulnerable decompression function, process memory corruption may result in denial of service, remote code execution, and other damage.
Actual exploitability therefore depends on whether the application or the libraries it uses have a path through which externally supplied Brotli-compressed data is decompressed. The following processing paths should be reviewed:
- Handling Brotli-compressed HTTP request data
- Automatically decompressing compressed responses received from external servers
- Decompressing uploaded files or external data using Brotli
Related functions include brotliDecompress(), brotliDecompressSync(), and createBrotliDecompress() in the node:zlib module.
Even if the application does not call these functions directly, middleware or HTTP client libraries may use them internally, so these should be checked as well.
■ How to Check for the Vulnerability
As this vulnerability resides in the native Brotli library bundled with Node.js, you need to verify the Node.js version actually used by your service and whether the security patch has been applied.
① Check the Node.js Version
Open a command prompt or terminal on Windows or Linux and run the following command.
– Command
node -v– Example Output
v22.23.3This output indicates that Node.js 22.23.3 is installed. Since this is earlier than the fixed version 22.23.4, a security update is required.
② Check the location of the Node.js executable
– Windows
where.exe node– Linux
command -v nodeThe path of the Node.js executable used in the current shell can also be checked with the following command.
node -p "process.execPath"Note that the commands above only identify the Node.js used in the current shell. Your actual service may be using a Node.js instance from a separate installation path, a version manager, a service account, or inside a container.
Therefore, the service’s execution configuration and the version inside the container must be verified separately. If necessary, process.version and process.execPath can be checked from within the actual application process via internal diagnostic logs.
③ Check Brotli Decompression Paths
Verify whether the application and the libraries it uses make use of Brotli decompression, and whether external input can reach that functionality. Version checks determine whether a patch is needed, while decompression path review determines whether the service is actually exposed.
■ Remediations
✔️ Operating environment review
- Check whether Node.js is installed, which version is in use, and whether it is a vulnerable version
- Check whether the application and its libraries use Brotli decompression
✔️ Apply security patches (*see the table above)
- For Node.js 22.x, 24.x, and 26.x, apply the security update corresponding to each version
- For end-of-life Node.js versions, upgrade to a supported version that includes the security patch
- After updating, restart the service and verify that the patched version is applied in the actual runtime environment
- In container environments, rebuild or replace the image with one that includes the fixed Node.js, then redeploy
✔️ If immediate updating is not possible
If the security patch cannot be applied immediately, we recommend the following temporary measures to prevent attacker-supplied Brotli data from reaching the vulnerable decompression function.
– If Brotli-compressed requests are handled: Block Brotli-compressed requests before the decompression stage, or temporarily disable the related functionality
– If external HTTP responses are decompressed: Consider disabling automatic Brotli decompression in the client library
– If external files or data are processed: Restrict Brotli decompression paths or temporarily suspend the related processing
※ Blocking request bodies alone may leave external server response or file processing paths exposed, so measures should be taken based on the actual decompression paths.
※ Access restrictions via firewalls and WAFs are supplementary measures only; applying the security patch is required for a fundamental fix.
※ If a Linux distribution or a separate vendor has backported the security fix, the patch may already be applied even if the Node.js version number is lower. Check the vendor’s security advisories and package change history as well.
■ Notes on Applying the Security Patch
This vulnerability stems from a memory handling flaw in the Brotli decoder bundled with Node.js. It cannot be resolved by adding input validation to the application or by running a standard npm update alone.
Depending on your environment, the following actions are required:
- Environments using official Node.js distributions: Update to a Node.js runtime binary that includes the security patch
- Environments that build Node.js from source: Rebuild and deploy using source code that includes the fix
- Products or executables that bundle their own Node.js runtime: Check for and apply the security update provided by the product vendor
In addition, since Brotli version information alone is not sufficient to accurately determine whether the patch has been applied, verification should be based on the official Node.js security release information or the vendor’s patch history.
Sparrow SCA, our open-source analysis and management tool, automatically detects the Node2Shell (CVE-2026-111497) vulnerability for which immediate updates are recommended.
Sparrow Co., Ltd. is committed to actively supporting you in minimizing the impact of this vulnerability and maintaining stable service operations.
If you have any questions, please feel free to contact our customer service center at any time.
(Contact) Technical Support / Incidents: +82-2-6263-7411