pwned.coffeeOrder ticket · today's special · 22 Oct 2026

SpreadingNot fixed everywhereDouble espresso · 355°CcriticalOrder up · fix available

HTTP2Shell

Brotli

Researchers have demonstrated a Node2Shell RCE exploit on Node.js using crafted Brotli data.

Do this now

Upgrade Node.js to 26.12.1, 24.22.1, or 22.23.4 matching your release line now.

Fix it

Node.js

On 22.xUpgrade to Node.js 22.23.4
On 24.xUpgrade to Node.js 24.22.1
On 26.xUpgrade to Node.js 26.12.1

Brotli

On 1.0.xUpgrade to Brotli 1.0.10
On 1.1.xUpgrade to Brotli 1.1.1
On 1.2.xUpgrade to Brotli 1.2.1

Brotli pip

pip install --upgrade "Brotli>=1.2.1"

Fixed for Node.js, Brotli and Python (Brotli); still cooking for bun, Envoy and C++ users of libbrotli.

First seen: 22 Oct 2026
Last update: 24 Oct 2026, 17:17 UTC
Fixed in: Node.js 26.12.1
Node.js 24.22.1
Node.js 22.23.4
Brotli 1.2.1
Brotli 1.1.1
Brotli 1.0.10
Identifiers: CVE-2026-111497
CVSS: 9.2
Source: news
On the menu as: Node.js
Python
PyPI packages

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## HTTP2Shell
Severity: critical. Patch status: patched.
Affected: Brotli
Fixed in: Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, Brotli 1.2.1, Brotli 1.1.1, Brotli 1.0.10
Ids: CVE-2026-111497

Researchers have demonstrated a Node2Shell RCE exploit on Node.js using crafted Brotli data.

## Steps
1. Search every lockfile and manifest (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements*.txt, poetry.lock, uv.lock, composer.lock, go.sum, Cargo.lock, Gemfile.lock) for `Node.js`, `Brotli`. For each hit, compare the installed version with the fix on the same major line: Node.js 26.12.1, Node.js 24.22.1, Node.js 22.23.4, Brotli 1.2.1, Brotli 1.1.1, Brotli 1.0.10. If it's lower, give the exact upgrade command for the package manager this repo uses.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111497") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/10/nodejs-brotli-decoder-bug-could-allow.html https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 https://thehackernews.com/2026/10/brotli-decoder-flaw-behind-nodejs-rce.html https://seclists.org/oss-sec/2026/q4/373
https://pwned.coffee/i/node2shell-rce-exploit-cve-2026-111497

Timeline

24 Oct 2026, 17:17 UTC
Brotli library and other software releases incorporate patch for CVE-2026-111497
24 Oct 2026, 11:17 UTC
The flaw also affects other widely used software.
23 Oct 2026, 21:17 UTC
Python packages are also vulnerable to the Node2Shell Brotli flaw
23 Oct 2026, 16:02 UTC
Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution
22 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Checked by hand “google/brotli v1.2.1 release notes say "SECURITY CVE-2026-111497"; the Brotli package on PyPI (the Python bindings from that repository) published 1.2.1 on 2026-10-22. PyPI has no 1.0.10 or 1.1.1 release (pypi.org/pypi/Brotli/json, checked 2026-10-24).” source
Fix by release line: Product Affected Fixed in Source
Node.js 26.x before 26.12.1 26.12.1 Vendor advisory
Node.js 24.x before 24.22.1 24.22.1 Vendor advisory
Node.js 22.x before 22.23.4 22.23.4 Vendor advisory
Brotli 1.2.0 to before 1.2.1 1.2.1 CVE record (CNA)
Brotli 1.1.0 to before 1.1.1 1.1.1 CVE record (CNA)
Brotli 1.0.3 to before 1.0.10 1.0.10 CVE record (CNA)
Brotli (pip) added 2026-10-23 before 1.2.1 1.2.1 Release notes
Investigating: Aikido reports more HTTP stacks that decode Brotli are affected and patching (bun, Envoy, C++ users of libbrotli). No vendor advisory checked for those yet: if a library you run decodes Brotli and has no fix, turn Brotli decoding off. source
Score: CVSS 9.2 (critical). CVSS 4.0 9.2 (CNA Google) for CVE-2026-111497
Last checked: 24 Oct 2026, 17:17 UTC

Product	Affected	Fixed in	Source
Node.js	26.x before 26.12.1	26.12.1	Vendor advisory
Node.js	24.x before 24.22.1	24.22.1	Vendor advisory
Node.js	22.x before 22.23.4	22.23.4	Vendor advisory
Brotli	1.2.0 to before 1.2.1	1.2.1	CVE record (CNA)
Brotli	1.1.0 to before 1.1.1	1.1.1	CVE record (CNA)
Brotli	1.0.3 to before 1.0.10	1.0.10	CVE record (CNA)
Brotli (pip) added 2026-10-23	before 1.2.1	1.2.1	Release notes

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee