Security advisory
Brotli decompression remote code execution vulnerability affecting Node.js and .NET (Node2Shell, CVE-2026-111497)
Status: Investigating. On October 21 and 22, 2026, the Node.js project and Google disclosed CVE-2026-111497 (Node2Shell), an out-of-bounds write in the Brotli decompression library bundled with Node.js, .NET and other software. An attacker who can supply crafted Brotli-compressed data, for example in an HTTP request or response, may be able to crash an application, read its memory or run code. Google rates it critical (CVSS 4.0 score 9.2) and proof-of-concept code is public. The Canadian Centre for Cyber Security issued advisory AV26-1085 on October 26, 2026.
Summary
On October 21 and 22, 2026, the Node.js project and Google disclosed CVE-2026-111497 (Node2Shell), an out-of-bounds write in the Brotli decompression library bundled with Node.js, .NET and other software. An attacker who can supply crafted Brotli-compressed data, for example in an HTTP request or response, may be able to crash an application, read its memory or run code. Google rates it critical (CVSS 4.0 score 9.2) and proof-of-concept code is public. The Canadian Centre for Cyber Security issued advisory AV26-1085 on October 26, 2026.
CVE: CVE-2026-111497
Status: Investigating
Nimble is reviewing whether any of its products, services or systems are affected. Nimble is checking its customer-facing products and services, internal business systems, and hosting provider infrastructure for Node.js, .NET and other software that includes the Brotli decompression library.
This advisory will be updated when the review is complete.
References
- Canadian Centre for Cyber Security, Advisory AV26-1085: cyber.gc.ca
- Node.js October 2026 security releases: nodejs.org
- Microsoft .NET security advisory CVE-2026-111497: github.com
- Google Brotli releases: github.com
Questions about this advisory? Contact security@nimble.ca.
Back to the Trust Center