Node2Shell exposure: what Node.js and Bun teams need to fix now

TL;DR: Attacker-controlled Brotli decompression can trigger remote code execution in Node.js and Bun across request bodies, fetch() responses and bundled runtimes, according to Ethiack's analysis of CVE-2026-111497, dubbed Node2Shell, with patched releases now available. The practical lesson is that runtime-bound parsing paths and bundled decoders create exposure even when the vulnerable code is not in application packages.

Editorial analysis by NHI Mgmt Group, based on content published by Ethiack: “Now Detecting: CVE-2026-111497 (Node2Shell)”.

Key questions

Q: What should teams do first when a runtime decoder flaw can reach code execution?

A: Patch the affected runtime first, then restart every process and rebuild every derived artifact.

Q: Why does a decompression flaw increase the risk around service credentials?

A: Because the vulnerable process often already holds secrets that matter to the business.

Q: What signs suggest a Brotli decoding issue has been exploited?

A: Look for decoder errors, unexpected crashes, and child processes such as shells, interpreters or download tools like curl and wget.

Practitioner guidance

• Patch affected runtimes immediately Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, or Bun to 1.4.4, then restart every process so the old binary cannot remain in memory.
• Rebuild every embedded artifact Recreate container images, single executable applications and bundled binaries from a fixed base so the vulnerable decoder is not carried forward.
• Inventory every Brotli decode path Find request bodies, fetch() calls, middleware and direct decompression calls that process untrusted Brotli data, then confirm which services are actually exposed.

Bottom line: The flaw turns ordinary Brotli handling into a remote code execution path inside Node.js and Bun runtimes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →