Free Node2Shell scanner - check for CVE-2026-111497
Scan your target for Node2Shell (CVE-2026-111497), the Brotli decoder flaw in Node.js, Bun, and Envoy, with this free scanner and download a PDF report you can share with your team.
It shows whether your endpoint decodes Brotli with a vulnerable decoder, the request and response behind the finding, and the fixed release for your runtime.
Already patched? Use this free Node2Shell checker to confirm your endpoint now rejects the malformed Brotli stream.
- Scan type
Light scan
Scan your target for Node2Shell (CVE-2026-111497), the Brotli decoder flaw in Node.js, Bun, and Envoy, with this free scanner and download a PDF report you can share with your team.
It shows whether your endpoint decodes Brotli with a vulnerable decoder, the request and response behind the finding, and the fixed release for your runtime.
Already patched? Use this free Node2Shell checker to confirm your endpoint now rejects the malformed Brotli stream.
Am I affected by Node2Shell?
You're affected if a service runs Node.js below 22.23.4, 24.22.1, or 26.12.1, Bun below 1.4.4, or Envoy or Istio with a Brotli decompressor filter below the fixed release for its branch, and that service decodes Brotli data an attacker can control.
Upgrade the runtime and rebuild any container images that bundle it. Node.js 20.x and older get no fix, so move to a supported line.
How we detect Node2Shell
While version checks tell you if a runtime could be vulnerable, they don't reveal if attacker-controlled Brotli ever reaches the decoder, and Node2Shell needs exactly that. So our scanner tests the decoding path first.
Baseline: it sends four one-byte POST requests to learn how the endpoint responds to normal and malformed Brotli. Every target receives these.
Escalation: only endpoints that decode Brotli request bodies then receive a Brotli stream of about 23 MB. A patched decoder rejects it as malformed. A vulnerable decoder accepts it.
Confirmation: a final one-byte request shows how the endpoint behaves after the stream. Every finding includes the full request and response, so you can verify it yourself or pass it to whoever owns the fix. Probe matches are marked with Certain confidence.
If the probe is inconclusive, the scanner falls back to version checks:
Envoy: it reads the version from an exposed admin API (
/server_info) and confirms through/config_dumpthat a Brotli decompressor is configured.Node.js and Bun: it reads a version the application discloses in response headers or in a health, status, or version endpoint.
What each result tells you
| Result | What it shows | What it doesn't show |
|---|---|---|
| Probe match | The endpoint decoded a Brotli request body with a vulnerable decoder | Code execution. The check doesn't run code on your server |
| Node.js or Bun version match | The disclosed version falls in the vulnerable range | That a Brotli decoding path is reachable |
| Envoy admin API match | The Envoy version and a configured Brotli decompressor | Request-path reachability. A reachable admin API is a separate exposure: it leaks the full proxy configuration and allows runtime changes |
Before you scan production: endpoints that decode Brotli request bodies receive an upload of about 23 MB. Plan for the bandwidth and any request-size alerts.
If a web application firewall or CDN rejects Brotli-encoded request bodies, the probe can't reach the decoder, and the scanner falls back to version checks. So a clean result from behind one doesn't prove the runtime is patched. Check the version inside the workload with node -v, bun --version, or envoy --version.
A WAF rule that rejects Content-Encoding: br does close one path to the decoder, and it's one of the temporary controls below. It doesn't cover fetch() calls that decode Brotli responses, so the upgrade still matters.
Node almost never exposes its version remotely, so any detection based on version strings is mostly guesswork.
That's why we prefer building active checks, which is what we did for Node2Shell. This active detection sends a request that exercises the decoding path directly and looks at how the runtime actually handles it.
This approach provides much more reliable results. We tested the check against a vulnerable environment running Node 22.23.3 to confirm it detects the issue correctly.
In the meantime, our research team is also digging into the mechanics of the bug to build a dedicated Sniper exploit module.
Product Security Manager at Pentest-Tools.com
Free Node2Shell scanner report (PDF) sample
Once the scan finishes, you get a PDF report you can share with whoever handles remediation. For Node2Shell, it includes:
the finding, with the endpoint and the result type behind it
the fixed release for each runtime, across Node.js, Bun, Envoy, and Istio
the severity rating and step-by-step remediation guidance, including how to stop disclosing your runtime version
The report also lists the open ports, DNS records, and technologies the scan found along the way.
Download sample report (PDF)
What is Node2Shell?
Technical details
CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder, versions 1.0.3 through 1.2.0. Node.js and Bun compile their own copy of that decoder into the runtime binary, and Envoy uses it in its HTTP decompressor filter. The flaw lives in the runtime, so an npm package named brotli has nothing to do with it.
A crafted Brotli stream can corrupt memory. Depending on the input and the code path, that means a crash, a leak of process memory, or remote code execution with the privileges of the Node.js, Bun, or Envoy process.
Two paths reach the decoder in Node.js applications:
- Request-body parsing that decodes Brotli, for example Express 5 with body-parser 2. A bare Node.js http server doesn't decode Brotli request bodies on its own.
- Server-side HTTP clients that decode Brotli responses, such as the built-in
fetch(). Code that fetches user-supplied URLs lets an attacker serve the malicious stream from a server they control.
Envoy is only exposed when an HTTP decompressor filter uses the Brotli library. Istio inherits the same exposure through its Envoy sidecars.
Imperva Red Team named the flaw Node2Shell. Some vendors now call it HTTP2Shell, because the same decoder ships in Python's Brotli and brotlicffi packages and other language bindings.
The fix sat in Google's Brotli repository from February 2026, eight months before Node.js shipped it. Dependencies compiled into your runtime don't show up in your package.json, so they need their own place in your inventory.
Versions vulnerable to Node2Shell
| Component | Vulnerable versions | Fixed in |
|---|---|---|
| Node.js 26.x | Below 26.12.1 | 26.12.1 |
| Node.js 24.x | Below 24.22.1 | 24.22.1 |
| Node.js 22.x | Below 22.23.4 | 22.23.4 |
| Node.js 20.x and older | All releases that bundle Brotli | No fix; move to a supported line |
| Bun | Below 1.4.4 | 1.4.4 |
| Envoy Proxy | Below the fixed release for each branch | 1.40.0, 1.39.3, 1.38.6, 1.37.8 (1.36.12 has the fix, but 1.36 is unsupported) |
| Istio | Below the fixed release for each branch | 1.31.2, 1.30.6, 1.29.9 |
| Google Brotli (C library) | 1.0.3 to 1.0.9, 1.1.0, 1.2.0 | 1.0.10, 1.1.1, 1.2.1 |
Sources: Node.js October 2026 security releases, Bun 1.4.4, Envoy releases, Istio security bulletin 2026-007, Brotli 1.2.1.
Version numbers don't provide full visibility. Container images pin the runtime they were built with, so a patched host can still run vulnerable containers. Some distribution packages lag behind upstream releases. Check your distro's security tracker and rebuild images, then confirm with node -v, bun --version, or envoy --version inside each running workload.
Node2Shell severity score unpacked
Google, the CVE Numbering Authority for Brotli, gives CVE-2026-111497 a CVSS v4.0 base score of 9.2 (Critical). The Node.js project rates it High in its own advisory.
The critical rating reflects three things:
- No authentication required: a remote, unauthenticated attacker can trigger the bug with a crafted Brotli stream.
- No user interaction required: nobody on the target side needs to click or approve anything.
- Runtime-level reach: any application on a vulnerable runtime that decodes untrusted Brotli inherits the flaw, whatever framework sits on top.
If leadership asks, here's the executive summary to give them: every unpatched service that decodes untrusted Brotli is a candidate for remote code execution. Services that never decode Brotli can't be reached through this flaw today, and they still need the upgrade, because the next code change can add a decoding path.
Node2Shell disclosure timeline
| Date | Event |
|---|---|
| February 27, 2026 | Google commits the fix to the Brotli repository, with no release or advisory. |
| October 21, 2026 | Node.js releases 22.23.4, 24.22.1, and 26.12.1. Google releases Brotli 1.0.10, 1.1.1, and 1.2.1. Bun releases 1.4.4. |
| October 22, 2026 | The CVE record goes public. A first proof of concept reaches code execution only on a deliberately weakened build. |
| October 22, 2026 | Imperva reports code execution on the official Node.js 24.22.0 Linux arm64 image. |
| October 25, 2026 | We add detection for CVE-2026-111497 to the Network Vulnerability Scanner. |
| October 26, 2026 | We launch this free Node2Shell scanner. |
Node2Shell exploitation - what attackers can do with it
Here's what researchers have shown so far, and what they haven't:
No credentials required: an attacker who can send Brotli-compressed request bodies, or make your application fetch Brotli responses from a server they control, can trigger the bug.
Code execution demonstrated: Imperva Red Team ran code on the official Node.js 24.22.0 image for Linux arm64, reaching the decoder through
fetch()and through Express 5 with body-parser 2. It took several attempts, and the fixed release rejected the same input.Public proof of concept: the first one, published October 22, reached code execution only on a deliberately weakened build. On a standard build, its author reported a crash and a limited memory read.
Exploited in the wild: no reports as of October 24, 2026. CISA's SSVC enrichment lists exploitation as none, automatable as no, and technical impact as total.
CISA KEV: not listed as of October 26, 2026.
If an attacker gets code execution, the impact is severe. The code runs with the privileges of the Node.js, Bun, or Envoy process, which puts these in reach:
environment variables and mounted secrets, including API keys and database credentials
cloud instance metadata and the IAM credentials behind it
internal services on the same network, through the proxy or the application's own connections
every request an Envoy proxy handles: Envoy runs as one shared process for all routes. If the memory corruption leads to code execution, the attacker controls that process and can read or change every request it handles, after TLS is decrypted.
The gap between a lab exploit and a reliable one can close fast once proofs of concept circulate. This month, PHP2Shell exploit attempts arrived before PHP even shipped its fix, so patch on your normal emergency track.
How to mitigate Node2Shell
The only complete fix is upgrading the runtime to a release that bundles the patched Brotli decoder. Pick the path that matches what you run.
Upgrade paths:
Node.js: upgrade to 22.23.4, 24.22.1, 26.12.1, or later, then rebuild every container image that bundles the runtime. On Node.js 20 or older, move to a supported line.
Bun: upgrade to 1.4.4 or later.
Envoy Proxy: upgrade to 1.40.0, 1.39.3, 1.38.6, 1.37.8, or later in the same supported branch.
Istio: upgrade to 1.29.9, 1.30.6, 1.31.2, or later, so the sidecars pick up the fixed Envoy.
Other Brotli bindings: update Python's Brotli to 1.2.1 and check brotlicffi, Java's brotli4j (fixed in 1.24.0), and the Ruby brotli gem (fixed in 0.9.1).
If you can't upgrade right away, these temporary controls shrink your exposure while you schedule the fix:
Reject request bodies with
Content-Encoding: brbefore any parser decodes them, at the proxy or in your middleware.Turn off Brotli decoding in server-side HTTP clients, especially code that fetches user-supplied URLs.
Disable the Envoy Brotli decompressor filter in both directions.
Bind the Envoy admin interface to localhost or a management network.
Stop disclosing the Node.js or Bun version in response headers and public health or status endpoints.
Note: each control closes one path to the decoder. Upgrading the runtime closes all of them.
Get a free Node2Shell scan report
Node2Shell references
- Pentest-Tools.com Vulnerability & Exploit Database - Node2Shell (CVE-2026-111497)
- Node.js - October 2026 security releases
- Bun - v1.4.4 release notes
- Envoy Proxy - releases
- Istio - security bulletin ISTIO-SECURITY-2026-007
- Google Brotli - v1.2.1 release
- NVD - CVE-2026-111497
- CVE.org - CVE-2026-111497
- Imperva - Node2Shell: from Brotli data to remote code execution
- Patch the Planet - Brotli
- The Hacker News - researchers demonstrate Node2Shell RCE
- Cycode - what to patch and how to find exposed services
About our Network Vulnerability Scanner
Our Network Vulnerability Scanner is a well-rounded tool for all your network security assessments.
It combines multiple engines and fine-tuned scan settings that surface more than 17,500 vulnerabilities, misconfigurations, and outdated services.
Each scan automatically updates your attack surface and provides an up-to-date map for planning targeted attacks or strategic lateral movements.
Explore a sample report, which includes a vulnerability summary, automatically confirmed findings, evidence, and more.
See what else it can doIn a transparent benchmark, our tool outperformed the 6 most popular network scanners on the market, both open-source and commercial.
FAQs
What is Node2Shell?
Node2Shell is the name Imperva Red Team gave CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled in Node.js, Bun, and Envoy. The name points to the worst-case outcome: someone sends crafted compressed data to your service and gets a shell on the server behind it. The CVE record rates it critical, with a CVSS v4.0 base score of 9.2.
Is Node2Shell the same as HTTP2Shell?
Yes. HTTP2Shell is a newer name some vendors use for CVE-2026-111497, because the same Brotli decoder flaw also affects Python packages and other libraries that decode HTTP content. Both names refer to one bug in Google's Brotli C decoder.
Does updating the npm brotli package fix Node2Shell?
No. Node.js compiles its own copy of the Brotli decoder into the runtime binary, and the npm package named brotli is a separate project. Upgrade Node.js itself to 22.23.4, 24.22.1, 26.12.1, or later, and rebuild your container images.
Is every Node.js application affected by Node2Shell?
Every Node.js release before the fixed versions contains the vulnerable decoder, but an application is only reachable if it decodes Brotli data an attacker controls. Common paths are Express 5 with body-parser 2 and fetch() calls to user-supplied URLs. A bare Node.js http server doesn't decode Brotli request bodies on its own. Upgrade either way, because code changes can add a decoding path later.
Does Node2Shell affect Python?
Yes. The same flaw is compiled into Python's Brotli and brotlicffi packages on PyPI, and Brotli 1.2.1 fixes it. This free scanner tests Node.js, Bun, and Envoy endpoints, so check Python services through your dependency inventory.
Why does the scan upload about 23 MB?
The probe needs a stream large enough to show whether the decoder rejects malformed Brotli the way a patched decoder does. Only endpoints that already decode Brotli request bodies receive it. Every other target gets four one-byte requests and nothing more.
Why are you offering a free scanner for Node2Shell?
Every day, our team develops tools, detections, and exploits to help security professionals find vulnerabilities before attackers can exploit them.
We know the fight is unfair: security teams follow strict rules, while threat actors do whatever they want. That's why we build free tools like this one, so security teams can validate their exposure quickly, without waiting for a scheduled scan or a costly engagement.