The Node.js Brotli RCE is now being exploited, not just theoretical
ELLIO recorded the first real attack against CVE-2026-111497 on 26 October, with a working remote code execution chain aimed at an unpatched Node.js build.
ELLIO’s threat research team recorded the first confirmed exploitation attempt against CVE-2026-111497, the Node.js Brotli decoder bug nicknamed Node2Shell, on 26 October at 15:08 UTC. Node.js patched the bug on 21 October in versions 22.23.4, 24.22.1 and 26.12.1, but until now there was no public record of anyone actually using it.
The attack ELLIO observed sent a single Brotli-compressed request body of just over 23MB at a Node.js v24.22.0 target, carrying a working remote code execution chain built from an original ROP chain with three previously unpublished gadgets. The bug is an out-of-bounds write in the bundled Brotli decoder, and it triggers wherever Node decompresses untrusted Brotli data, including the built-in fetch() and request bodies parsed by Express 5. The flaw carries a CVSS score of 9.2.
Why it matters: this moves Node2Shell from “patch when convenient” to “patch now” for anyone still running an affected build. If your app decompresses Brotli from a source you don’t fully control, the risk is no longer theoretical.
The caveat: ELLIO recorded one confirmed attempt against one target. That’s enough to show working exploit code exists and is being used, but it isn’t evidence of mass scanning yet.