Updating Node.js is only half the Node2Shell fix

· · Security Infrastructure

If your business runs any software that fetches pages from the internet, accepts uploads, or talks to other companies' systems, there is a good chance it unpacks compressed data with a small piece of Google code called Brotli. Most of the people who run that software have never heard of it. As of this week they need to, because a flaw in it is being exploited and the fix does not arrive in one update.

The flaw is CVE-2026-111497, usually called Node2Shell because Node.js was the first project to patch it. A crafted compressed file or web response can write past the end of a small buffer in memory. That can crash the program, leak what is in its memory, or let an attacker run their own code. No login is needed. The US security agency CISA added it to its list of known exploited vulnerabilities on 27 October.

It arrived the same week as PHP2Shell, which took most of the attention. This one reaches further.

Where Brotli hides

Brotli is not a product anyone buys. It is built into other software, and that is the problem: the fix has to travel through every project that carries a copy, then to every business running that project.

  • Node.js. Its built-in fetch() unpacks Brotli responses on its own, so any server your application talks to can send the payload. Node.js fixed it on 21 October in 22.23.4, 24.22.1, and 26.12.1. Versions 25, 23, 20, and older are out of support and will not get a fix.
  • Python. If the Brotli or brotlicffi package is installed, the popular web libraries requests, urllib3, aiohttp, and httpx use it automatically, even if your own code never mentions it. The fixed versions are Brotli 1.2.1 and brotlicffi 1.2.1.0. The independent tracker at broccoli2shell.com notes that the usual dependency scanners did not reliably flag these packages at first, so check by hand.
  • .NET. Microsoft released emergency updates on 25 October: 8.0.33, 9.0.22, and 10.0.14. Brotli is off by default in .NET, so only applications that turned it on are exposed, but your developers will know whether theirs did.
  • PHP on Windows. PHP rebuilt its Windows packages on 26 October to include the fixed Brotli. The PHP version number does not change, so php -v looks the same before and after. The new builds carry a -1 in the file name, such as 8.4.27-1.
  • Palo Alto firewalls. PAN-OS 11.2, 12.1, and 12.2 are affected when traffic decryption and Brotli inspection are both switched on, because the firewall then unpacks web traffic passing through it. Palo Alto's advisory lists hotfixes, the last of them due on 30 October, and a setting to turn Brotli inspection off until then.

Other software that bundles its own copy needs its own update: database tools, archive programs, image and video processing, and more. The broccoli2shell.com list showed several popular projects still unfixed on 28 October.

Why updating is not enough

Three things catch people out.

A running program keeps the old code. Installing the update changes the file on disk, not the process already in memory. Every service has to be restarted.

Containers keep it until they are rebuilt. If your software runs in containers, the vulnerable library is baked into the image. Rebuild every image on a patched base, then redeploy. Update the version pins in your lock files too, or the next build quietly puts the old version back.

Updating the server's own Brotli does not fix programs that bring their own. Node.js carries its own copy, so only the Node.js version matters there. The same goes for anything else that bundles one.

Patching is slow so far. In Qualys's telemetry, only 42,000 of 3.3 million Node.js installations had been patched by 27 October, and 1.7 million were on versions that will never get a fix. Those need moving to a supported version, which is a bigger job than an update.

Researchers at Imperva showed they could run code on an official, unmodified Node.js image, though it took several attempts. Exploit traffic using a public proof of concept was first reported on 26 October. Whether attacks are succeeding at scale is not yet clear. That is not a reason to wait.

What to do this week

If you have developers, or someone builds software for you, ask them four things:

  • Which of our services run Node.js, Python with the Brotli package, or .NET, and which versions?
  • Have the fixed versions been deployed, and have the containers been rebuilt and the services restarted, not just the packages updated?
  • Is anything on Node.js 20, 23, or 25, or older, and what is the plan to move it?
  • Do we run any software that bundles its own Brotli, and has its supplier released a fix?

If you look after the systems yourself, start with anything reachable from the internet that fetches web addresses, receives webhooks, or accepts uploads. Patch, restart, and rebuild. Where you cannot patch yet, block incoming Brotli-compressed requests at the proxy or firewall, and uninstall the Python Brotli packages if nothing needs them: the web libraries fall back to other compression. Blocking incoming requests does not protect software that fetches from the internet, so the update is still the only full fix.

If you run Palo Alto firewalls with traffic decryption, check the hotfix list today, or turn Brotli inspection off until you can install it.

How Steelwise can help

Finding every place a library like this is hiding, and checking that "we've patched" includes the rebuild and the restart, is the kind of review we do for software teams. Get in touch and we will help you work through it.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.