Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Key Points:

• A critical vulnerability (CVE-2026-111497), dubbed Node2Shell, was found in Google's Brotli compression library, affecting versions 1.0.3 through 1.2.0, with a CVSS v4 score of 9.2; fixed versions include 1.0.10, 1.1.1, and 1.2.1.
• The bug allows an out-of-bounds write that can cause memory corruption, leading to crashes, memory leaks, or arbitrary code execution by unauthenticated attackers if malicious Brotli data reaches the decoder.
• Updates and patches have been released by Microsoft (for .NET, Visual Studio, and PowerShell), Node.js, Python packages (Brotli and brotlicffi), and other projects like Bun, Envoy, and Istio; unpatched software still includes DuckDB, Apache Arrow, and 7-Zip-zstd among others.
• The vulnerability was discovered by OpenAI Codex Security during red-teaming, with fixes made in Brotli's source code as early as February, though the security implications were only recently understood and disclosed.
• Exploitation requires attacker-controlled compressed data reaching the decoder, and while no widespread attacks have been reported, proof-of-concept exploits have demonstrated code execution on specific Linux arm64 Node.js builds, emphasizing the need for prompt patching and service restarts.