# Node2Shell: OpenAI's Codex Security team found a Brotli decoder RCE

> Node2Shell is an out-of-bounds write in the Brotli decoder, reported by OpenAI's Codex Security team and patched across Brotli and Node.js.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability, Research
- **Published by:** Node.js
- **Disclosed:** 2026-10-21
- **CVE:** CVE-2026-111497
- **CVSS:** 9.2
- **Affects:** Brotli, Node.js, brotli (PyPI), brotlicffi (PyPI)
- **Research by:** Khai Tran (OpenAI Codex Security), Sylvie Mayer (OpenAI Codex Security)
- **Primary source:** https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- **Page:** https://theinjection.dev/items/brotli-node2shell-decoder-oob-write/

Node2Shell is an out-of-bounds write in the Brotli decoder that a crafted compressed stream can turn into remote code execution. OpenAI's Codex Security team reported it. Brotli, Node.js and the PyPI brotli packages are patched.

## What happened

Node.js published a security release on 21 October 2026 that fixed CVE-2026-111497, an out-of-bounds write in the Brotli decoder. The advisory credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, for reporting the flaw, and Node.js contributors mcollina and aduh95 for fixing it. Google released patched Brotli versions the same day, and the GitHub advisory covering the Brotli libraries followed on 22 October.

## How it works

An invalid block switch in a Brotli stream was reported as a temporary need for more input rather than a permanent format error. The streaming decoder therefore kept appending input bytes into an eight-byte internal buffer, writing past it and corrupting adjacent decoder state. Google's record classes the bug as CWE-787 and CWE-252, an out-of-bounds write following an unchecked return value. A remote, unauthenticated attacker reaches the path with a crafted compressed stream.

## Who is affected

Brotli 1.0.3 through 1.2.0 are affected, which pulls in Node.js 22.x, 24.x and 26.x and the brotli and brotlicffi packages on PyPI. Any application that decompresses untrusted Brotli input is in scope, which for Node.js means anything passing attacker-supplied data to node:zlib. Jan Schaumann wrote on the oss-security list that other Brotli consumers are affected too, citing an Envoy security advisory.

## What to do

Upgrade Brotli to 1.0.10, 1.1.1 or 1.2.1, and Node.js to 22.23.4, 24.22.1 or 26.12.1. Rebuild or repackage anything that bundles Brotli statically, and update brotli or brotlicffi on PyPI. Node.js publishes no workaround, so patching is the only remedy.

## Quick facts

- **Affected:** Brotli 1.0.3 to 1.2.0, Node.js 22.x, 24.x and 26.x, brotli and brotlicffi on PyPI
- **Fixed in:** Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1
- **CVE:** CVE-2026-111497
- **CVSS:** 9.2 (v4.0), Critical, assigned by Google
- **Attack type:** Out-of-bounds write, CWE-787 and CWE-252
- **Found by:** Khai Tran and Sylvie Mayer, OpenAI Codex Security
- **Disclosed:** 21 October 2026, in the Node.js security release

## Questions

### Is Node.js patched against the Brotli decoder flaw?

Node.js shipped fixes on 21 October 2026 in versions 22.23.4, 24.22.1 and 26.12.1, covering CVE-2026-111497 in all three supported release lines. The Node.js advisory lists no workaround, so upgrading is the only remedy. End-of-life lines are always affected by a security release, so unsupported branches stay exposed.

### Which Brotli versions are affected by CVE-2026-111497?

Google Brotli 1.0.3 through 1.2.0 are affected, and the fixed releases are 1.0.10, 1.1.1 and 1.2.1. On PyPI the brotli package is affected below 1.2.1 and brotlicffi below 1.2.1.0. Google is the assigning CNA and rates the flaw 9.2 on CVSS v4.0, while the Node.js advisory rates its own exposure High.

### How did OpenAI find the Brotli vulnerability?

Node.js credits OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, for reporting the flaw. The Node.js advisory does not describe the method they used, and OpenAI's own write-up could not be retrieved for this item, so no discovery detail is claimed here. Google's Brotli 1.2.1 release notes list the CVE without naming a reporter.

### Am I exposed if my application does not use Node.js?

Any software that decompresses untrusted Brotli data with a vulnerable Brotli build is exposed, not only Node.js. On the oss-security list, Jan Schaumann noted that other Brotli consumers are affected, cited an Envoy security advisory, and suggested OpenSSL could be affected where it processes Brotli-compressed certificates. Schaumann also warned that some distributions rated the flaw only medium priority.

### What does the Brotli decoder flaw actually corrupt?

The Brotli decoder treated an invalid block switch as a temporary need for more input instead of a permanent format error, per the Node.js advisory. The streaming decoder then kept appending input bytes to an eight-byte internal buffer, corrupting adjacent decoder state. Outcomes named by the advisories are a crash, disclosure of process memory, and remote code execution.

## Sources

1. [Node.js Advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
2. [Brotli Advisory](https://github.com/advisories/GHSA-9v8h-qqgm-4m35)
3. [Brotli 1.2.1 Release](https://github.com/google/brotli/releases/tag/v1.2.1)
4. [OSS-Security Thread](https://www.openwall.com/lists/oss-security/2026/10/23/25)