Node2Shell: Node.js Brotli decoder vulnerability (CVE-2026-111497), check and patch

DECODES BROTLI  fetch() response                       sends Accept-Encoding: gzip, deflate
DECODES BROTLI  axios response                         sends Accept-Encoding: gzip, compress, deflate, br
no              http.get() response                    no automatic decompression
DECODES BROTLI  Express 5 express.json() request body  HTTP 200 {"got":"brotli"}
no              Express 4 express.json() request body  HTTP 415 {"error":"encoding.unsupported"}

#!/usr/bin/env node
// node-brotli-check.mjs: is this Node.js fixed for CVE-2026-111497 (Brotli
// decoder out-of-bounds write), and where does a project decode Brotli data?
//   node node-brotli-check.mjs [project-path]
// Run it with the SAME node binary that runs your app (check `which node`,
// your Dockerfile, or your platform's runtime setting).
// Exit code: 0 = fixed, 1 = action needed.
import { existsSync, readFileSync, readdirSync } from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";
import zlib from "node:zlib";

const FIXED = { 22: "22.23.4", 24: "24.22.1", 26: "26.12.1" };

const parts = (v) => v.replace(/^v/, "").split(".").map(Number);
export function atLeast(version, minimum) {
  const a = parts(version);
  const b = parts(minimum);
  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
  return true;
}

/**
 * The fix added a new decoder error code (-17) and Node.js exposes it as
 * zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. Its presence is the
 * most direct sign that the patched decoder is built in; the version number
 * is the second signal.
 */
export function assessRuntime({ version, hasFixConstant, sharedBrotli }) {
  const major = parts(version)[0];
  const fixed = FIXED[major];
  const versionOk = fixed ? atLeast(version, fixed) : false;

  if (hasFixConstant) {
    return {
      status: "fixed",
      reason: versionOk || !fixed
        ? `Node.js ${version} has the patched Brotli decoder.`
        : `Node.js ${version} is below ${fixed} but has the patched decoder (a vendor backport).`,
    };
  }
  if (sharedBrotli) {
    return {
      status: "check",
      reason: `This Node.js uses the system Brotli library. Update the OS brotli package (it must include google/brotli commit 0ed4268), then Node.js itself.`,
    };
  }
  if (!fixed) {
    return {
      status: "vulnerable",
      reason: `Node.js ${major}.x is end of life and gets no fix. Move to 24.22.1 or 26.12.1 (or 22.23.4).`,
    };
  }
  return {
    status: "vulnerable",
    reason: versionOk
      ? `Node.js ${version} reports a fixed version but lacks the fix marker: rebuild or reinstall from nodejs.org.`
      : `Node.js ${version} is below the fixed release ${fixed}.`,
  };
}

// --- project scan: where Brotli from outside gets decoded -------------------
function readJson(file) {
  try {
    return JSON.parse(readFileSync(file, "utf8"));
  } catch {
    return null;
  }
}

function installedVersion(root, name) {
  return readJson(path.join(root, "node_modules", name, "package.json"))?.version ?? null;
}

const SOURCE_EXT = /\.(m?[jt]sx?|cjs)$/;

export function scanProject(root) {
  const findings = [];
  const express = installedVersion(root, "express");
  const bodyParser =
    readJson(path.join(root, "node_modules", "express", "node_modules", "body-parser", "package.json"))?.version ??
    installedVersion(root, "body-parser");
  if (bodyParser && parts(bodyParser)[0] >= 2) {
    findings.push(`body-parser ${bodyParser}${express ? ` (express ${express})` : ""}: express.json()/urlencoded() decode Brotli request bodies from any client.`);
  }
  const axios = installedVersion(root, "axios");
  if (axios) findings.push(`axios ${axios}: asks servers for Brotli and decodes responses.`);

  let usesFetch = false;
  let usesZlibBrotli = false;
  const walk = (dir) => {
    for (const entry of existsSync(dir) ? readdirSync(dir, { withFileTypes: true }) : []) {
      if (entry.name === "node_modules" || entry.name.startsWith(".") || entry.name === "dist" || entry.name === "build") continue;
      const full = path.join(dir, entry.name);
      if (entry.isDirectory()) walk(full);
      else if (SOURCE_EXT.test(entry.name)) {
        const text = readFileSync(full, "utf8");
        if (/\bfetch\s*\(/.test(text)) usesFetch = true;
        if (/createBrotliDecompress|brotliDecompress/.test(text)) usesZlibBrotli = true;
      }
    }
  };
  walk(root);
  if (usesFetch) findings.push("fetch(): decodes Brotli responses even without asking for them.");
  if (usesZlibBrotli) findings.push("zlib Brotli decompression called directly in your code.");
  return findings;
}

// --- CLI -----------------------------------------------------------------------
if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
  const runtime = {
    version: process.version,
    hasFixConstant: zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH !== undefined,
    sharedBrotli: Boolean(process.config?.variables?.node_shared_brotli),
  };
  const result = assessRuntime(runtime);
  console.log("Node.js Brotli check (CVE-2026-111497)");
  console.log(`node:        ${runtime.version} (bundled brotli ${process.versions.brotli}; this number does not change with the fix)`);
  console.log(`fix marker:  ${runtime.hasFixConstant ? "present" : "missing"}`);
  console.log(`status:      ${result.status.toUpperCase()}`);
  console.log(`why:         ${result.reason}`);

  const root = process.argv[2] ? path.resolve(process.argv[2]) : null;
  if (root) {
    const findings = scanProject(root);
    console.log("");
    console.log(`Where ${path.basename(root)} decodes Brotli from outside:`);
    for (const f of findings.length ? findings : ["nothing found (the runtime should still be updated)"]) console.log(`  - ${f}`);
  }
  process.exit(result.status === "fixed" ? 0 : 1);
}

# with the same node binary that runs your app
node node-brotli-check.mjs            # runtime only
node node-brotli-check.mjs ./my-api   # runtime + where the project decodes Brotli
echo "exit code: $?"                  # 0 = fixed, 1 = action needed

node-v20.20.2  fix marker: missing  VULNERABLE  (end of life, no fix)
node-v24.22.0  fix marker: missing  VULNERABLE  (below 24.22.1)
node-v24.22.1  fix marker: present  FIXED
node-v26.12.0  fix marker: missing  VULNERABLE  (below 26.12.1)
node-v26.12.1  fix marker: present  FIXED
process.versions.brotli: 1.2.0 on every 24.x and 26.x build above, patched or not

Where my-api decodes Brotli from outside:
  - body-parser 2.4.0 (express 5.3.0): express.json()/urlencoded() decode Brotli request bodies from any client.
  - axios 1.20.0: asks servers for Brotli and decodes responses.
  - fetch(): decodes Brotli responses even without asking for them.

# nvm
nvm install 24.22.1 && nvm alias default 24.22.1

# fnm
fnm install 24.22.1 && fnm default 24.22.1

# Windows
winget upgrade OpenJS.NodeJS.LTS

# Ubuntu/Debian with the NodeSource repository
sudo apt update && sudo apt install --only-upgrade nodejs

# Then restart every long-running process, for example:
pm2 restart all          # or: sudo systemctl restart my-api

// Stop-gaps for Express 5 apps until the Node.js update is deployed:
// both keep Brotli request bodies away from the decoder.
import zlib from "node:zlib";
import { createRequire } from "node:module";
const express = createRequire(import.meta.url)("express");

const br = zlib.brotliCompressSync(Buffer.from(JSON.stringify({ hello: "brotli" })));
const plain = JSON.stringify({ hello: "plain" });

// Option A: body-parser's own switch. Rejects every compressed body (gzip too).
function optionA() {
  const app = express();
  app.use(express.json({ inflate: false }));
  return app;
}

// Option B: refuse only Brotli, keep gzip and deflate working.
function rejectBrotliBodies(req, res, next) {
  const encoding = String(req.headers["content-encoding"] ?? "").toLowerCase();
  if (encoding.split(",").some((e) => e.trim() === "br")) {
    return res.status(415).json({ error: "Brotli request bodies are not accepted" });
  }
  next();
}
function optionB() {
  const app = express();
  app.use(rejectBrotliBodies);
  app.use(express.json());
  return app;
}

async function probe(name, app) {
  app.post("/", (req, res) => res.json({ got: req.body?.hello ?? null }));
  app.use((err, _req, res, _next) => res.status(err.status ?? 500).json({ error: err.type ?? err.message }));
  const server = await new Promise((r) => {
    const s = app.listen(0, () => r(s));
  });
  const url = `http://127.0.0.1:${server.address().port}/`;
  const send = async (body, encoding) => {
    const headers = { "content-type": "application/json" };
    if (encoding) headers["content-encoding"] = encoding;
    const res = await fetch(url, { method: "POST", headers, body });
    return `${res.status} ${await res.text()}`;
  };
  console.log(`${name}`);
  console.log(`  plain JSON:  ${await send(plain)}`);
  console.log(`  brotli JSON: ${await send(br, "br")}`);
  console.log(`  gzip JSON:   ${await send(zlib.gzipSync(plain), "gzip")}`);
  server.close();
}

await probe("Option A: express.json({ inflate: false })", optionA());
await probe("Option B: rejectBrotliBodies before express.json()", optionB());

Option A: express.json({ inflate: false })
  plain JSON:  200 {"got":"plain"}
  brotli JSON: 415 {"error":"encoding.unsupported"}
  gzip JSON:   415 {"error":"encoding.unsupported"}
Option B: rejectBrotliBodies before express.json()
  plain JSON:  200 {"got":"plain"}
  brotli JSON: 415 {"error":"Brotli request bodies are not accepted"}
  gzip JSON:   200 {"got":"plain"}