October 23, 2026 Threats 7 min read

Node.js Security Patch for Brotli Vulnerability: What Canadian Businesses Should Do

By Omer Segoly, CISM | Published October 23, 2026

A Node.js security patch released October 21, 2026 addresses CVE-2026-111497, a flaw in the Brotli decoder that the Node.js Project says can permit remote code execution. Node.js rates it high severity; Google, as the CVE numbering authority, scored it CVSS v4.0 9.2 (Critical). Canadian organizations running web applications, APIs, or backend services on Node.js should update to the fixed versions immediately: 22.23.4, 24.22.1, or 26.12.1.

The vulnerability is in code that Node.js bundles rather than in your own application code. Any Node.js application that decompresses Brotli data from an untrusted source (a request body, a response fetched from another server) can be at risk.

Update: October 23, 2026

The vulnerability is also being referred to as HTTP2Shell, reflecting that it affects HTTP clients and servers beyond Node.js, according to Aikido Security. The underlying flaw is in Google's Brotli decoder, and other software that bundles it is affected:

• Bun 1.0.21 through 1.4.3 is vulnerable. Bun 1.4.4, released October 22, 2026, includes the fix. See the Bun security advisory.
• Python Brotli (the PyPI package) through 1.2.0 is vulnerable. Version 1.2.1 contains the fix.
• Python brotlicffi through 1.2.0.2 is vulnerable. Version 1.2.1.0 contains the fix. See the GitHub advisory for the Python packages.

One independent researcher has argued that the flaw can only cause a crash (denial of service), not code execution, according to a Brandefense analysis. Public proof-of-concept code mostly shows crashes. Researchers have separately reported code execution on an official Node.js 24.22.0 build, though not on every attempt. This does not diminish the need to patch: a crash can still take down a production service.

What Is the Node.js Brotli Vulnerability?

CVE-2026-111497 is a buffer overflow in the Brotli decoder component of Node.js, reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer and fixed by Node.js maintainers mcollina and aduh95, according to the Node.js October 21, 2026 security advisory. Malformed Brotli-compressed input can trigger an out-of-bounds write during decompression.

Brotli is a compression algorithm developed by Google, and Node.js ships its own copy of the Brotli library. The underlying flaw affects Google Brotli versions 1.0.3 through 1.2.0, according to the CVE record. Google released fixes in Brotli 1.0.10, 1.1.1, and 1.2.1 on October 21, 2026.

The Node.js Project rated this vulnerability "high" severity. Google, as the CVE numbering authority, assigned a CVSS v4.0 base score of 9.2 (Critical), according to the NVD entry and the official CVE record. The NVD lists this as a secondary source and has not issued its own score; its status remains "Awaiting Analysis." No CVSS v3.1 score appears in the official CVE record.

Which Node.js Versions Are Affected?

According to the Node.js Project's security advisory, the vulnerability affects all three currently supported release lines:

• Node.js 22.x versions before 22.23.4
• Node.js 24.x versions before 24.22.1
• Node.js 26.x versions before 26.12.1

Node.js 25.x, 23.x, 20.x, and earlier have reached end of life. They do not receive security updates and remain permanently vulnerable to this flaw. Organizations running Linux distributions that package their own Node.js builds should note that some distros link Node.js against the system Brotli library rather than the bundled copy; in that case, the fix arrives via the distribution's Brotli package, according to Aikido Security's analysis.

How Could an Attacker Exploit This?

An application is exposed when it decompresses Brotli data that an attacker controls. This can happen in two main ways:

1. Request bodies: A web server that accepts Brotli-compressed request bodies could decompress malicious data sent by an attacker.
2. Fetched responses: A Node.js application that calls external APIs or fetches content from the web could decompress a malicious response from a compromised or attacker-controlled server. The fetch() API in Node.js automatically decodes Brotli-compressed responses, according to Aikido and Imperva.

According to Aikido and Imperva, Express 5 and body-parser 2.x decompress Brotli-encoded request bodies, so endpoints using json() or raw() middleware can pass attacker data to the vulnerable decoder. The vulnerable code is in Node.js itself, not in Express. A bare Node.js HTTP server does not automatically decode incoming Brotli bodies.

Imperva researchers reported a working proof of concept in their test setup, publishing their findings on October 22, 2026 under the name "Node2Shell" in a blog post. They demonstrated code execution on an official Node.js 24.22.0 Linux arm64 build using crafted Brotli data; on the patched release (24.22.1), the same input was rejected. The researchers noted the exploit did not succeed on every attempt and they did not test every build.

As of October 23, 2026, no confirmed exploitation in the wild has been reported. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

What Should Canadian Organizations Do Now?

Patch immediately. The Node.js advisory lists no workaround.

Step 1: Identify where Node.js runs. Node.js may be present in web applications, API servers, build tools, CI/CD pipelines, and container images. Ask your IT provider or development team for an inventory.

Step 2: Check the version. Run node --version on each system. Any version in the 22.x, 24.x, or 26.x lines before the fixed releases needs updating.

Step 3: Update to fixed versions. Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1. If you use container images, rebuild them with a patched base image.

Step 4: Move off end-of-life versions. If any systems still run Node.js 20.x or earlier, 23.x, or 25.x, migrate them to a supported release line.

Step 5: Verify the update applied. Confirm the new version is running in production, not just installed.

Has the Canadian Centre for Cyber Security Issued an Advisory?

As of October 23, 2026, no Canadian Centre for Cyber Security advisory specific to CVE-2026-111497 has been published on the alerts and advisories page.

Regardless of whether a Canadian advisory appears, the underlying guidance remains the same: patch operating systems and applications promptly. The Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations lists patch management as Baseline Control BC.2 and recommends enabling automatic updates or running a vulnerability and patch management program.

Why Does This Matter for Software Supply Chain Security?

This vulnerability illustrates a common pattern in supply chain risk: the flaw is in a bundled dependency (Google Brotli), not in Node.js's own code or your application code. Keeping Node.js updated automatically pulls in fixes for components you may not have known were there.

A patch management process that covers only operating systems misses vulnerabilities like this one. Runtime environments (Node.js, Python, Java), their bundled libraries, and any third-party packages your applications depend on all need regular updates.

This is why a cybersecurity assessment should include questions about how your organization handles software dependencies and runtime updates, not just Windows patches.

What If My Business Cannot Patch Immediately?

The Node.js advisory lists no workaround. If you cannot update right away, reduce exposure where possible:

• Limit inbound Brotli-compressed traffic at the network edge if your web application firewall supports rejecting requests with Content-Encoding: br headers.
• Review which applications fetch content from external servers and whether they decompress Brotli responses.

These measures reduce risk but do not eliminate it. Only the patch removes the vulnerability.

One Question to Ask Your IT Provider

"Which production systems run Node.js, and have they been updated to 22.23.4, 24.22.1, or 26.12.1?"

If your provider cannot answer that question, or if the answer reveals that runtime versions are not actively tracked, that is a sign that software inventory and patch management practices may need review as part of your next cybersecurity assessment.

Sources cited:

• Node.js October 21, 2026 Security Releases (primary source for CVE, affected versions, fixed versions, severity)
• NVD CVE-2026-111497 (CVSS v4.0 9.2 score from Google as CNA)
• Official CVE Record (CVE details)
• Imperva: Node2Shell (proof of concept, Express/body-parser analysis)
• Aikido: Node2Shell Analysis (affected versions, Express/body-parser analysis, distro-packaged Node)
• Aikido: HTTP2Shell and Python Packages (HTTP2Shell name, Python package impact)
• Bun Security Advisory GHSA-663w-cv8g-jj2p (Bun vulnerability and fix)
• GitHub Advisory GHSA-9v8h-qqgm-4m35 (Python Brotli package advisory)
• CCCS Baseline Cyber Security Controls (patch management guidance)

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Node.js Security Patch for Brotli Vulnerability: What Canadian Businesses Should Do. Retrieved from https://cybersecuritycanada.ca/news/posts/nodejs-brotli-vulnerability-what-canadian-businesses-should-do/

Permanent URL: https://cybersecuritycanada.ca/news/posts/nodejs-brotli-vulnerability-what-canadian-businesses-should-do/ · Published October 23, 2026