Node2Shell Brotli Flaw Spreads to Python, Bun, Envoy
Node2Shell, the critical Brotli decoder flaw in Node.js, now affects Python, Bun and Envoy too. Here are the patched versions and what to upgrade first.
A serious security flaw that started in Node.js is turning out to be much bigger than first thought. The flaw, called Node2Shell, sits in the Brotli compression decoder, and this week it has been confirmed in Python packages, Bun, Envoy and Istio as well. If your software decompresses Brotli data sent by someone else, you should check your versions now.
What is Node2Shell
Brotli is a compression format made by Google that shrinks web traffic before it travels over the internet. Node.js bundles its own copy of the Brotli decoder, and that copy had an out-of-bounds write bug: crafted compressed data could trick the decoder into writing past the end of a memory buffer. Node.js rates the flaw, tracked as CVE-2026-111497, as high severity and says it permits remote code execution. That means an attacker could potentially run their own code on a vulnerable server. The CVE record from Google scores it 9.2 on the CVSS 4.0 scale, which is in the critical range. The flaw was reported by researchers at OpenAI Codex Security. Not every app is exposed. The danger only applies when attacker-controlled Brotli data reaches a vulnerable decoder. But that happens more often than many teams realise, because Brotli decoding is often automatic.
How the scope grew this week
Node.js shipped its fix on October 21, in versions 22.23.4, 24.22.1 and 26.12.1. The same day, the Brotli project released fixed library versions 1.2.1, 1.1.1 and 1.0.10. Then the picture widened. On October 22, researchers reported running code on an unmodified Node.js 24.22.0 build in lab conditions, although the exploit did not work on every attempt. No exploitation in the wild had been reported as of that day. On October 23, Envoy published a critical advisory for the same bug, with fixes in versions 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. The same day, the Python packages Brotli and brotlicffi were confirmed affected, fixed in versions 1.2.1 and 1.2.1.0. Istio also shipped fixes in 1.29.9, 1.30.6 and 1.31.2. By October 24, Bun was calling the same flaw HTTP2Shell in its own posts. It is the same CVE with a second name, not a second flaw. Bun fixed it in version 1.4.4.
Who is affected and what to upgrade
The flaw reaches an app in three main ways. First, servers that accept compressed request bodies: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding br, and any client can send one. Second, apps that call other servers: Node.js fetch() decompresses Brotli responses automatically, so a compromised or attacker-controlled server can reach your app through its response. Third, code that uses node:zlib directly with untrusted input. Here are the patched versions to move to: - Node.js: 22.23.4, 24.22.1 or 26.12.1, depending on your release line - Brotli library: 1.2.1, 1.1.1 or 1.0.10 - Python: Brotli 1.2.1 and brotlicffi 1.2.1.0 - Bun: 1.4.4 or newer, and rebuild any compiled executables - Envoy: 1.40.0, 1.39.3, 1.38.6, 1.37.8 or 1.36.12 - Istio: 1.29.9, 1.30.6 or 1.31.2 One warning matters most for older systems. Node.js lines 20, 23 and 25 are end of life and will never receive this fix. Teams on those lines must move to a supported line. Container images pinned to an old tag also stay vulnerable until they are rebuilt on a patched version, even if they are rebuilt often.
What to do if you cannot upgrade yet
The Node.js advisory offers no workaround, but two stopgaps reduce exposure while you prepare the upgrade. You can reject incoming requests with Content-Encoding br at your reverse proxy or load balancer, and edge platforms such as Vercel added firewall rules blocking the attack on October 21. Those stopgaps only cover inbound requests. They do not protect against Brotli responses your app fetches from other servers. Only a runtime upgrade removes the flaw, so treat any stopgap as a bridge to the upgrade, not a replacement for it. Start with the services that accept compressed request bodies or call user-supplied URLs, then work through the rest. The fix itself is a routine version bump, and with public proofs of concept already circulating, delay only raises the risk.
Sources
- Node.js - https://nodejs.org/en/blog/vulnerability/october-2026-security-releases - Aikido - https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 - Brandefense - https://brandefense.io/blog/node2shell-nodejs-brotli-rce-cve-2026-111497/