CVE-2026-111497: 
Schwachstellenanalyse und -minderung

CVE-2026-111497, dubbed "Node2Shell" (also referred to as "HTTP2Shell" and "Broccoli2Shell"), is a critical buffer overflow (out-of-bounds write) vulnerability in the Google Brotli decoder (c/dec/decode.c). It affects Google Brotli versions 1.0.3 through 1.2.0 on all platforms and is widely embedded in Node.js, Python packages (brotli, brotlicffi), .NET, Bun, Envoy, Istio, ClickHouse, DuckDB, Apache Arrow, PAN-OS, and many other software ecosystems. The vulnerability was reported by OpenAI Codex Security researchers (Khai Tran and Sylvie Mayer) and publicly disclosed on October 22, 2026, with Node.js security releases issued on October 21, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Node.js Advisory).

The root cause is an out-of-bounds write (CWE-787) combined with an unchecked return value (CWE-252) in the Brotli streaming decoder. When the decoder encounters an invalid block-switch in a malformed Brotli-compressed stream, it incorrectly reports the condition as a temporary need for more input rather than a permanent format error. As a result, the streaming decoder continues appending input bytes to an internal eight-byte buffer beyond its bounds, corrupting adjacent decoder state memory. An attacker who can supply crafted Brotli-compressed data to any application that decompresses it (e.g., via node:zlib, HTTP Content-Encoding: br, or any library binding to the vulnerable C decoder) can trigger this condition without authentication or user interaction. The fix, applied in Brotli commits 0ed4268, b418fa8, da98063, and 50a9b70, adds proper rejection of invalid block-switch structures (GitHub Advisory, Node.js Advisory).

Successful exploitation can result in process memory corruption, disclosure of sensitive memory contents, denial of service (crash), or remote code execution on the affected system. Because the vulnerable Brotli C decoder is bundled in Node.js (reachable via zlib.brotliDecompress, createBrotliDecompress, and fetch() with Content-Encoding: br), Python PyPI packages, .NET, Bun, Envoy, Istio, PAN-OS, and dozens of other widely deployed software products, the blast radius is exceptionally broad. Researchers demonstrated RCE on official Node.js 24.x Linux/ARM64 builds, and the vulnerability also affects supply-chain dependencies across Go, Perl, and other ecosystems that bundle the vulnerable C library (GitHub Advisory, Node.js Advisory, Palo Alto Networks).

CVE-2026-111497 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog with a federal patch deadline of October 29, 2026 (CISA KEV, Security Affairs). Multiple public proof-of-concept repositories exist on GitHub demonstrating DoS and memory corruption; Imperva and Ellio.tech independently validated RCE on stock Node.js builds (Imperva Blog, Ellio.tech Blog). The EPSS score is approximately 32.8% (with the GitHub Advisory reporting an 87.99th percentile exploitation probability). Honeypots logged active attack attempts, and Sophos reported in-the-wild exploitation (Sophos). No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance: Identify internet-facing services that accept Brotli-compressed input — web servers, APIs, or proxies running Node.js (< 22.23.4, < 24.22.1, < 26.12.1), Python with brotli/brotlicffi (< 1.2.1), .NET (< 8.0.33, < 9.0.22, < 10.0.14), or other software bundling Google Brotli 1.0.3–1.2.0. Use Shodan, Censys, or HTTP fingerprinting to identify targets advertising Accept-Encoding: br.
2. Craft malformed Brotli stream: Construct a Brotli-compressed stream containing an invalid block-switch structure — specifically, manipulate the NBLTYPES (number of block types) field in the metablock header to trigger the decoder's erroneous "need more input" path instead of a format error. Tools like craft_payloads.py from public PoC repositories generate such payloads by bit-flipping NBLTYPES fields or using structured fuzzing.
3. Deliver payload: Send the crafted Brotli stream to the target via HTTP POST with Content-Encoding: br header (e.g., curl -X POST https://target/api/endpoint -H 'Content-Encoding: br' --data-binary @malformed.br), or via any other channel where the application decompresses attacker-controlled Brotli data (WebSocket, file upload, etc.).
4. Trigger out-of-bounds write: The vulnerable decoder appends bytes past the end of its internal 8-byte buffer, corrupting adjacent heap memory (decoder state). On unpatched builds, the decoder does not return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH.
5. Achieve impact: Depending on heap layout and exploitation sophistication — (a) DoS: the process crashes immediately; (b) Memory disclosure: leaked heap contents may be returned in error responses; (c) RCE: with heap grooming and knowledge of memory layout (demonstrated on ARM64 Linux Node.js 24.x builds by Imperva and Ellio.tech), an attacker can redirect execution to attacker-controlled code, achieving a shell on the target system (GitHub Advisory, Imperva Blog, Node.js Advisory).

• Network: Inbound HTTP requests with Content-Encoding: br containing malformed or unusually short Brotli payloads (< 30 bytes); repeated POST requests to API endpoints with Content-Encoding: br from unexpected source IPs; outbound connections from Node.js/Python/application processes to unknown external IPs following Brotli decompression activity.
• Logs: Application logs showing BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH errors absent on unpatched builds (patched builds emit this error; absence on a system that should be patched may indicate bypass); Node.js crash dumps or core files in application directories; unexpected process exits with signal SIGSEGV or SIGABRT from the application process.
• File System: Unexpected web shells, scripts, or binaries written to application directories or /tmp; new cron jobs or systemd units created by the application service account; modified Node.js binary or Brotli shared library (libbrotlidec.so) timestamps.
• Process: Unusual child processes spawned by Node.js, Python, or .NET application processes (e.g., /bin/sh, bash, curl, wget, python3); unexpected network connections initiated by the application process; elevated memory usage or heap corruption signals in APM telemetry during Brotli decompression operations.
• Detection Tools: Nuclei template available at github.com/projectdiscovery/nuclei-templates (PR #17522); scanner tools including assetnote/node2shell-scanner, TahuCryptsi/node-brotli-check, and trailofbits/brotli-checker can fingerprint unpatched deployments by probing for the absence of BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH in error responses.

Primary remediation: Update the Google Brotli library to version 1.0.10, 1.1.1, or 1.2.1. For specific ecosystems:

• Node.js: Upgrade to 22.23.4, 24.22.1, or 26.12.1 (Node.js Advisory).
• Python: Upgrade brotli to ≥ 1.2.1 and brotlicffi to ≥ 1.2.1.0 (GitHub Advisory).
• Microsoft .NET: Apply the out-of-band security update (8.0.33, 9.0.22, 10.0.14) (Microsoft MSRC).
• Bun: Upgrade to ≥ 1.4.4; Go (andybalholm/brotli): upgrade to ≥ 1.2.7.
• Envoy: Upgrade to 1.37.8, 1.38.6, or 1.39.3; Istio: upgrade to 1.29.9, 1.30.6, or 1.31.2.
• PAN-OS: Apply hotfix versions per the Palo Alto advisory; as a workaround, disable Brotli inspection via CLI (set system setting brotli-encoding disable) or Web UI (Palo Alto Networks).
• WAF mitigations: Cloudflare deployed emergency WAF rules blocking malformed Brotli requests; Azure WAF and AWS WAF also issued protective rules — enable these as a temporary control while patching.
• General: Audit all software dependencies for bundled Brotli copies (self-contained .NET apps, Docker images, vendored libraries); prioritize services that accept Brotli-encoded input from untrusted sources.

The vulnerability generated exceptional industry attention, being dubbed "Black October" alongside concurrent PHP and GitLab vulnerabilities. OpenAI was credited with discovering the flaw via its Codex Security team and published a dedicated advisory page. Imperva and Ellio.tech independently demonstrated RCE on official Node.js builds, publishing detailed technical write-ups (Imperva Blog, Ellio.tech Blog). Cloudflare deployed emergency WAF rules within days of disclosure. Microsoft issued an out-of-band .NET security update on a Sunday — an unusual move highlighting urgency. Fortinet published an outbreak alert for Node2Shell. SANS ISC and BleepingComputer covered active exploitation, with the latter reporting CISA's KEV addition (BleepingComputer). Security researchers on Mastodon, Bluesky, and X widely discussed the supply-chain implications, noting that the vulnerable Brotli C decoder is embedded in hundreds of software products beyond Node.js. The community coined multiple names for the vulnerability (Node2Shell, HTTP2Shell, Broccoli2Shell) reflecting its cross-ecosystem impact. JFrog Research published "Brotli2Shell" analysis extending the scope beyond Node.js and HTTP stacks (JFrog Research).