OPSDEN.
Explore the library
← All security intelligenceOPS DEN / INDEPENDENT TECHNICAL BRIEFING
SOFTWARE SUPPLY CHAIN / DECODERUPDATED 2026-11-04
High / assess exposure5 min READ

node2shell

A flawed Brotli decoder can be reached when a server expands compressed content supplied by another party. Review inbound decompression and outbound HTTP fetches, even if the application does not call Brotli directly.

CVE-2026-111497
Article link ↗
OPERATOR VIEWWhat needs attention

Identify running services and images with the affected decoder. Map deployed runtime builds and bundled libraries to current vendor security releases.

What happened

CVE-2026-111497 is an out-of-bounds write involving malformed input in the Brotli decoder. The vulnerable decoder can write beyond a small internal buffer. A process that decompresses attacker-controlled Brotli data can crash or suffer memory corruption.

Node.js includes Brotli functionality in its zlib APIs and via HTTP clients. Server-side fetch, proxy, preview, and remote-image functions can receive compressed responses from an untrusted endpoint. The shared Brotli code also appears outside Node.js, so an inventory limited to npm dependencies is incomplete.

The Node.js project issued security releases for the 22.x, 24.x, and 26.x lines on October 21, 2026. Products that embed their own decoder must be checked with their own vendors. Cloudflare says its relevant WAF rules default to Log, which does not block traffic by itself.

Where to look

  • Node.js web servers that accept Brotli request bodies or decode Brotli content from remote responses.
  • Server-side URL previews, webhook processing, fetch proxies, image optimizers, and crawler functions.
  • Native libraries, language runtimes, and container images that bundle the affected Brotli decoder.

Initial investigation

  1. Identify running Node.js and other Brotli-enabled workloads. Capture runtime and image build versions.
  2. Map where external clients can supply compressed bodies or cause the server to fetch compressed content.
  3. Compare runtime builds with Node.js vendor advisories and other component suppliers' security notices.
  4. Review whether application-level limits and any documented WAF rules are configured to act as compensating controls.

Operator commands

READ-ONLY EXAMPLES

Use these commands to collect evidence. Confirm the running service and vendor security fix before assigning patch status.

Node.js runtime and bundled decoder · read-only
node -p 'process.version'
node -p 'process.versions.brotli'
node -p 'process.versions.undici'
OpenShift workloads · identify application images
oc get deploy -A -o wide
oc get pods -A -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name,IMAGES:.spec.containers[*].image

Remediation plan

  1. Update the runtime and any separately distributed Brotli decoder through the relevant vendor security release.
  2. Rebuild and redeploy affected images. Confirm that the running process uses the updated decoder, including replicas.
  3. Review inbound request decoding and outbound fetch features. Apply additional restrictions when vendor guidance requires them.

Evidence to retain

  • Service, image digest, runtime version, and bundled Brotli version where identifiable.
  • User-controlled decompression paths, including HTTP client and remote-image functions.
  • Vendor patch reference, deployed image digest, and verification date.
  • WAF rule actions and traffic paths outside their coverage.

References

EXTERNAL SOURCES

Read the analysis on Ops Den. Open a reference only when you need the current vendor release or primary evidence.

LOCAL ASSESSMENT

Track your environment

Saved only in this browser. Ops Den does not receive or store your selections.