Node2Shell exposes Node.js and Bun runtimes to remote code execution

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Ethiack's report: CVE-2026-111497 lets remote attackers turn Brotli decompression in Node.js and Bun into code execution when services process untrusted compressed data.

Why it matters: This matters because internet-facing runtimes can inherit exploitable parser logic from the platform itself, so patching, rebuilds and exposure validation become identity-adjacent operational controls when services hold secrets and tokens.

Context

Node.js and Bun services often decompress data before application logic ever sees it, which makes the runtime a security boundary, not just an execution layer. When that decompression happens on untrusted input, memory corruption in the decoder can become remote code execution or data leakage.

The identity implication is direct: internet-facing services that hold database passwords, API keys, application secrets and cloud tokens become higher-value targets once their runtime can be driven into a crash or shell. That turns exposed runtime versions into a governance problem, not only a patching problem.

Key questions

Q: What should teams do first when a runtime decoder flaw can reach code execution?

A: Patch the affected runtime first, then restart every process and rebuild every derived artifact. If the decoder is embedded in containers, compiled binaries or bundled distributions, the vulnerable code remains active until those artifacts are replaced. Exposure control only works when the runtime itself is replaced, not when the application package is updated alone.

Q: Why does a decompression flaw increase the risk around service credentials?

A: Because the vulnerable process often already holds secrets that matter to the business. If remote code execution or memory leakage occurs, an attacker can reach database passwords, API keys, application secrets or cloud tokens from the same process. That turns a parser bug into a credential exposure problem, especially on internet-facing services.

Q: What signs suggest a Brotli decoding issue has been exploited?

A: Look for decoder errors, unexpected crashes, and child processes such as shells, interpreters or download tools like curl and wget. Those signals matter because a successful exploit may fail visibly before privilege is fully established, or it may only leak memory while still leaving operational traces. Treat those traces as compromise indicators, not noise.

Q: When should organisations treat bundled runtimes as a security incident?

A: Treat them as an incident when an internet-facing service used a vulnerable runtime after public disclosure and had access to sensitive credentials. The issue is not only whether exploitation was confirmed, but whether the process could have exposed secrets while untrusted compressed data was being handled. That is a scenario where containment and credential rotation are both justified.

Technical breakdown

How a Brotli decoder flaw becomes remote code execution

Brotli is a compression format, and the decoder is the code that expands compressed input back into normal data. In this case, the flaw is an out-of-bounds write, which means attacker-controlled bytes can corrupt memory while decompression is happening. Because Node.js and Bun ship their own Brotli implementation, the vulnerable code sits inside the runtime binary, not in an npm dependency. That matters because applications can be exposed through ordinary request handling or response processing even when their package manifests look clean. Practical implication: treat the runtime build as part of your attack surface, not just the application code. See the Node.js Permission Model Guide.

Practical implication: Inventory runtime versions wherever compressed data is accepted or fetched.

Why request bodies and fetch() responses both create exposure

The attack surface appears anywhere attacker data reaches the decoder. In practice, that includes request bodies with Content-Encoding: br, framework middleware that decompresses by default, direct Brotli decompression calls, and fetch() responses that ask servers for Brotli automatically. The result is broader than a single parser bug because exposure depends on how the service handles inbound and outbound traffic. A service can be vulnerable even if it never explicitly chose to enable compression. Practical implication: map every path that inflates or fetches compressed content, then test those paths against the vulnerable runtime versions.

Practical implication: Review every compressed-data path, including middleware and outbound fetch behaviour.

Why bundled runtimes and rebuilt images matter

This issue persists inside container images, single executable builds and bundled distributions because the vulnerable decoder is carried with the runtime itself. Patching the host alone is not enough if a container or compiled artifact still includes an affected Node.js, Bun or Brotli version. That creates a lifecycle problem for inventory, rebuilds and post-fix validation. It also affects certificate of trust around deployment artifacts because a supposedly fresh build can still ship an old decoder. Practical implication: rebuild every derived artifact from a fixed base and verify the embedded runtime version before redeployment.

Practical implication: Rebuild and verify every artifact that embeds the runtime.

Threat narrative

Attacker objective: Gain code execution on internet-facing Node.js or Bun services and extract useful secrets or further access from the compromised process.

1. Entry occurs when an attacker sends a request body, response payload or direct Brotli input that reaches a vulnerable decoder.
2. Credential or code-access escalation follows if memory corruption is steered into remote code execution on the target process.
3. Impact is compromise of the service runtime, with possible leakage of memory-resident secrets and downstream access to cloud or database credentials.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure: CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime-native parsing defects now belong in identity governance reviews. When a server runtime can be driven into code execution by compressed input, the blast radius includes the secrets that service can reach, not just the process that crashes. That makes runtime versioning, rebuild discipline and process restart evidence relevant to NHI governance whenever applications hold API keys, database passwords or cloud tokens.

Node2Shell is a disclosure-and-lifecycle failure, not just a code defect. The upstream fix existed for months before a release or advisory, which means vulnerable versions can persist quietly in production even when teams believe they are current. The governance gap is the absence of dependable exposure awareness across runtimes, images and compiled artifacts, especially where service credentials sit close to the process boundary.

Compressed input is an attack path because default behaviour expands trust. Framework defaults that accept Brotli on request bodies or fetch() responses can extend trust to external data before application logic has a chance to inspect it. That creates a control gap between network acceptance and safe parsing, so identity-protected services need to treat decompression as a security-sensitive boundary and vulnerability management as an operational control, not a periodic checklist.

Exposed internet-facing runtimes should be treated as credential-bearing assets. If a vulnerable Node.js or Bun service handled attacker-controlled Brotli, the right question is not only whether code execution happened but what secrets were reachable at the time. That is the moment to think about service accounts, API keys and cloud tokens as part of the exploit surface, not just the post-exploitation cleanup.

The named concept here is parser trust expansion. Default decompression behaviour widens the trust boundary from HTTP transport to runtime memory handling, and that expansion is what makes a low-level decoder bug operationally dangerous. Practitioners should recognise that any feature which automatically inflates untrusted content can move risk from content handling into credential exposure and execution control.

What this signals

Parser trust expansion: the real problem is not compression itself but the way default inflation moves untrusted data directly into a memory-unsafe runtime boundary. Organisations that depend on Node.js or Bun should assume their exposure window includes every path that automatically decodes attacker-controlled content, including outbound fetch behaviour.

The immediate programme impact is asset truth. If you cannot tell which internet-facing services embed the affected runtime, whether they decode Brotli, and which secrets those processes can reach, patching becomes guesswork rather than control. That is why runtime inventory and rebuild verification belong beside patch management, not after it.

For practitioners

• Patch affected runtimes immediately Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, or Bun to 1.4.4, then restart every process so the old binary cannot remain in memory.
• Rebuild every embedded artifact Recreate container images, single executable applications and bundled binaries from a fixed base so the vulnerable decoder is not carried forward.
• Inventory every Brotli decode path Find request bodies, fetch() calls, middleware and direct decompression calls that process untrusted Brotli data, then confirm which services are actually exposed.
• Block vulnerable compression paths as a temporary control Reject Content-Encoding: br at the edge and disable body inflation where practical, knowing this does not fix Brotli responses consumed by fetch().
• Rotate secrets after suspected exposure If an internet-facing vulnerable service ran after 21 October, check for crashes or child processes and rotate any database passwords, API keys, application secrets or cloud tokens it could reach.

Key takeaways

• The flaw turns ordinary Brotli handling into a remote code execution path inside Node.js and Bun runtimes.
• The exposure is operationally serious because affected processes may also hold database passwords, API keys, application secrets and cloud tokens.
• Teams need to patch runtimes, rebuild embedded artifacts and rotate secrets where vulnerable services may have handled attacker-controlled compressed data.

Related NHI Mgmt Group resources: Vulnerability Management Guide · CVE, CWE and CPE Guide · LiteLLM Proxy Security Guide · GitLab Security Guide

Key terms

• Brotli Decoder: The Brotli decoder is the component that expands compressed Brotli data back into normal bytes for an application or runtime. When the decoder contains memory-safety bugs, attacker-controlled compressed input can become a code execution or data leakage path before the application layer can validate it.
• Runtime-Bundled Vulnerability: A runtime-bundled vulnerability exists when the flaw lives inside the shipped execution environment rather than in a separately managed application dependency. That matters because patching the app package alone does not remove the vulnerable code if the container image, binary build or runtime version still embeds it.
• Compression Boundary: A compression boundary is the point where external content is automatically decompressed before business logic handles it. In security terms, it is a trust boundary because unsafe defaults can move untrusted input into memory handling, expanding the attack surface for remote code execution and memory disclosure.
• Exposure Surface: The set of data, endpoints, and signals that can be observed or queried by an external party. For identity security, the exposure surface is broader than the access surface because publicly visible fields can still be abused for recon and profiling.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, secrets management and workload identity as part of the industry's only accredited NHI security programme. It helps practitioners connect runtime exposure to identity and access decisions across their broader security programme.