Brotli Vulnerability CVE-2026-111497 (Node2Shell): What Crypto Users Should Know

Last updated: October 29, 2026

CVE-2026-111497 — also called Node2Shell, HTTPS2Shell or Brotlipocalypse — is a critical out-of-bounds write in Google's Brotli decompression library that can lead to remote code execution in Node.js, Bun, Python apps, Envoy and Istio when they decompress malicious data. It is fixed in Node.js 22.23.4, 24.22.1 and 26.12.1, Brotli 1.0.10, 1.1.1 and 1.2.1, and Bun 1.4.4. For crypto users the practical risk sits in software that talks to the internet: trading bots, Telegram bots, self-hosted payment tools and desktop apps built on Node.js. Update them from official sources. And watch out for fake "urgent security update" downloads, which always follow news like this.

• 9.2 CVSS 4.0 severity
• 3 Node.js branches patched (22, 24, 26)
• 1.0.3 first affected Brotli version
• 6 major platforms affected

What is the Brotli bug?

Brotli is a compression format created by Google. Web servers use it to shrink pages and API responses, and clients unpack them automatically. The bug is in the decoder: on a specially crafted malformed block it asks for more input instead of stopping, and keeps writing bytes past the end of a small internal buffer. Depending on the program, that means a crash, leaked memory or, in the worst case, the attacker's code running on the machine. Every Brotli version since 1.0.3 is affected, and because the decoder is copied into many projects, patching one doesn't patch the others.

Researchers at Imperva published a working exploit for Node.js 24.22.0 on Linux ARM64. It needed no special build, though it can take several attempts. The bug was found by researchers on OpenAI's Codex Security team. At the time of writing, no mass exploitation has been reported.

Who is affected and which version fixes it

The attacker needs your program to unpack data they control: a malicious request sent to your server, or a malicious response from a server your program fetches. A plain Node.js HTTP server doesn't decompress request bodies on its own; frameworks and middleware can. The same Node.js release also fixed TLS certificate hostname checks that unusual IP-address formats could bypass (CVE-2026-106069, CVE-2026-105483) and a DNS bug that truncated hostnames at a null byte (CVE-2026-105482).

What it means for crypto users

• Bots and scripts. Trading bots, price trackers and Telegram bots are often written in Node.js or Python and constantly fetch data from APIs. If one of those servers is compromised, or you call an untrusted one, the response can carry the exploit. Update the runtime and rebuild Docker images: an image built last month still has last month's Node.js.
• Desktop apps on Electron. Many desktop crypto apps are built on Electron, which ships its own copy of Node.js. Updating Node.js on your computer doesn't touch it, so install the app's own update.
• Self-hosted tools. Payment plugins, node dashboards and anything else exposed to the internet: check what they run on and update.
• Fake updates. Scammers use big vulnerability news to push "emergency patches" that are really wallet stealers. Update only through the app itself or the developer's site, and verify the download. See also fake browser extensions.
• Hot wallets on servers. A remote code execution bug on a server that holds private keys means losing the keys. Keep long-term funds in a cold wallet, not on a machine that talks to the internet all day.

Checklist for developers and self-hosters

1. Check versions: node -v, bun --version, pip show brotli brotlicffi, and your Envoy or Istio version.
2. Update and rebuild: pull fresh base images (node:22-alpine and others) and rebuild containers. Restarting the old container is not enough.
3. Upgrade from end-of-life branches: Node.js 20.x and older get no fix.
4. Turn off what you don't need: don't decompress untrusted Brotli request bodies or upstream responses if your app doesn't require it.
5. Scan: Trail of Bits published a Brotli Checker that finds vulnerable decoder copies in code, dependencies and containers.

Is notkyc affected?

No. We checked our stack after the disclosure: notkyc's backend doesn't decompress Brotli anywhere, and our servers already run the patched system library. Exchanges listed on notkyc run their own infrastructure, so watch their announcements too. Real incidents with listed services show up on the no-KYC track record.

Frequently asked questions

Patch your tools, keep keys offline and swap without leaving accounts behind: compare offers on /swap — for example BTC → XMR. Related: GitLab's 12-year-old RCE bug and DNS hijacking of crypto sites.

Sources: Node.js security release, Xakep, SecurityLab.