Node2Shell Brotli Flaw Now Confirmed Exploited and Spreading Into Microsoft and Python Builds
Our earlier advisory, Brotli2Shell frequently asked questions for the Google Brotli decoder vulnerability (CVE-2026-111497), covered this flaw when it was still understood mainly as a Node.js problem. The picture has moved on in three ways. First, the exposure is wider than the runtime it was first found in: Microsoft issued out-of-band security updates on 25 October for .NET 8, 9 and 10 plus .NET 11 Release Candidate 3, because its own Brotli decompression implementation carries the same defect, and separate research identified the vulnerable decoder code in the Python packages Brotli and brotlicffi, with vulnerable builds running up to 1.2.0 and 1.2.0.2 respectively. Second, the flaw now has a working public proof of concept and a name, Node2Shell, given to it after remote code execution was demonstrated independently by a commercial security vendor. Third, and most importantly, CVE-2026-111497 was added to the CISA Known Exploited Vulnerabilities catalogue on 27 October 2026, which moves it from theoretical to confirmed in-the-wild exploitation. At the time the public write-up was published, no exploitation had been reported.
The technical root cause is unchanged from the earlier advisory but worth restating briefly because it explains the breadth. The decoder mishandles an invalid block-type transition inside a compressed stream: the DecodeBlockTypeAndLength() function can return an ambiguous failure value, and the decoder's fast path does not check that value properly, so processing continues against an invalid internal state and performs an out-of-bounds write that corrupts process memory. The weakness is a pairing of an unchecked return value (CWE-252) with an out-of-bounds write (CWE-787), and the consequences range from denial of service and information disclosure through to remote code execution. The published proof of concept targets a Node.js 24.22.0 Linux x86-64 build, depends on that specific binary and memory layout, and is probabilistic in nature, needing retries in some runs. The same repository shows the request failing against Node.js 24.22.1, where the decoder correctly rejects the invalid block switch. Because every affected product carried a copy of the same upstream decoder logic, each vendor has had to ship its own fix rather than wait on a single library bump.
The operational significance of the update is that the affected population is now much larger than a list of Node.js versions. Any service that decompresses attacker-controlled Brotli data, such as untrusted HTTP responses or request bodies, is in scope, and that includes .NET web applications, Python services pulling in Brotli or brotlicffi as a transitive dependency, and container images that bundle a vulnerable runtime inside a deployed artefact. The .NET case carries an additional wrinkle: self-contained deployments and Native AOT builds link the decoder directly into the executable, so a host with a fully updated shared runtime can still be running vulnerable code. The exploitation evidence is no longer ambiguous. The CISA KEV listing of 27 October 2026 confirms active exploitation, and FIRST assesses a 55.5 percent probability of exploitation activity in the next 30 days, one of the higher EPSS figures seen for a decompression bug. Patched releases exist across the whole affected set: Node.js 22.23.4, 24.22.1 and 26.12.1, the .NET runtimes 8.0.33, 9.0.22, 10.0.14 and 11.0.0-rc.3.26522.148, Python Brotli 1.2.1 and brotlicffi 1.2.1.0, and upstream Google Brotli 1.0.10, 1.1.1 and 1.2.1. End-of-life Node.js lines received no fix and remain affected. For a SOC covering internet-facing web tiers or API gateways, the combination of a public exploit, a confirmed KEV entry and a decoder that sits in the default request path makes this an overnight item rather than a Monday one.
Attack Surface
Web Application, Supply Chain (Third-party vendors), Cloud Service, Server OS
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1203 – Exploitation for Client Execution
- T1195.001 – Compromise Software Dependencies and Development Tools
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Apply Microsoft's 25 October out-of-band updates for CVE-2026-111497, moving to .NET runtime 8.0.33, 9.0.22 or 10.0.14, and 11.0.0-rc.3.26522.148 for the preview line, along with the matching updated SDKs.
- Rebuild and redeploy any .NET application published as a self-contained deployment or with Native AOT, because the Brotli decoder is linked into the executable and patching the shared runtime on the host does not replace it.
- Update Python dependencies to Brotli 1.2.1 and brotlicffi 1.2.1.0, and treat any build pinning Brotli at or below 1.2.0 or brotlicffi at or below 1.2.0.2 as vulnerable, including transitive pins found in requirements.txt, poetry.lock and Pipfile.lock.
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later; the proof of concept works against 24.22.0 on Linux x86-64 and fails against 24.22.1. End-of-life Node.js lines received no fix and should be migrated to a supported release.
- Rebuild container images that bundle a Node.js, .NET or Python runtime rather than only patching hosts, and run an SBOM or syft or grype scan across the registry for libbrotlidec, brotli below 1.1.1 or 1.2.1 and brotlicffi below 1.2.1.0.
- Pin or rebuild against Google Brotli 1.0.10, 1.1.1 or 1.2.1 for any in-house C or C++ component that statically links the decoder, as the fix for the DecodeBlockTypeAndLength block-switch handling lives upstream.
- Alert on crash loops, segmentation faults or abnormal child process creation in services that accept Content-Encoding br request bodies or decompress third-party HTTP responses, since the public exploit is probabilistic and generates repeated failed attempts before succeeding.
