Node2Shell: How One Tiny Compression Bug Put the Whole Internet on Patch Duty

In one week, a tiny bug in a tool that shrinks files on the internet became one of the year’s biggest security scrambles. Working attack code went public, hackers started testing it, and the US government’s cyber agency (CISA) added the flaw to its list of bugs being used in real attacks. Its official name is CVE-2026-111497. Everyone is calling it Node2Shell.

The bug that was already fixed (and nobody noticed)

Here’s the part that makes this story great. Brotli’s public source code fixed the root cause on February 27, 2026. A Google engineer, Evgenii Kliuchnikov, submitted a small change titled “Detect and report invalid stream earlier.” There was no security note, no alarm, and no official bug ID. It looked like routine cleanup.

The catch is that Brotli didn’t ship a new release for months. So for roughly eight months, the vulnerable decoder kept shipping inside Node.js, Python packages, browsers, firewalls, and containers, even though the fix was sitting in plain sight on GitHub.

OpenAI later summed it up well: the issue was fixed in the source back in February, but nobody knew it was a security vulnerability, and no newer release picked it up.

Quick primer if Brotli is new to you. It’s a compression format from Google, a way of shrinking files so websites load faster. When a site sends you its pages or app data in a smaller package, Brotli likely squeezed it, and your browser or app has to unpack it when it arrives. The bug lives in that unpacking step, in a part of the software called the decoder. Google rated it 9.2 out of 10 for severity, which is the “Critical” tier.

How a white lie turns into a shell

The bug is a great example of how a tiny logic mistake can become a major security problem. Think of a mail-sorting machine. Packages arrive in a stream, and the machine has two ways to complain: “this package is damaged, throw it out” or “I’m still waiting for more mail, keep it coming.” Those are very different messages.

Brotli’s decoder works the same way. Its data is chopped into chunks, and sometimes the data says “switch to a different type of chunk.” But in one odd case there’s only one type, so there’s nothing to switch to, and the instruction is invalid. A well-behaved decoder should say “this file is broken” and stop.

Instead, it gave the exact reply it uses for “I’m waiting for more data.” Two different situations, one identical answer.

So the program kept feeding it more. The decoder has a tiny holding area for leftover bytes, only eight bytes wide. Normally that area empties. In this broken case, it never did, and the leftovers kept piling up until they spilled over the edge into memory they had no business touching.

Spilling data into the wrong place in memory is a classic way hackers break in. Suppose an attacker controls what gets written and where; they can crash the program, peek at secrets, or take over the machine and run their own commands. That last one is where the “Shell” in Node2Shell comes from.

One bug, a hundred front doors

The name “Node2Shell” is a little misleading. It isn’t really a Node.js bug. Node.js, a popular tool for running websites and apps, was just the first and loudest place it showed up, because Node carries its own copy of Brotli. The flaw lives in Google’s shared code, so anything with a copy inherits the problem. That’s why you’ll also see nicknames like HTTP2Shell and Broccoli2Shell floating around.

The scale is wild. Cloud security firm Wiz estimated that 91% of cloud environments have something vulnerable to this bug, and 82% have publicly reachable Node.js servers.

To use it, an attacker must get a vulnerable program to unpack booby-trapped data. There are two main ways:

Send it in. The attacker sends a web request with booby-trapped compressed data, and the server unpacks it automatically before anyone looks at it.
Make the app fetch it. The attacker tricks an app into visiting a website they control, and that site replies with booby-trapped data. This matters for link previews, automated notifications, and AI tools that browse the web, and it sneaks past defenses that only watch incoming traffic.

It doesn’t stop at one tool or language. The same decoder is inside Python programs, Microsoft’s .NET, the Bun runtime, firewalls, browsers like Firefox and Chrome, and desktop apps such as Slack, Discord, Signal and VS Code. Each carries its own copy, so each had to be fixed separately. That’s what turned one bug into dozens of emergencies.

From fix to attack in six days

The speed of this one is what made security people sweat. From the day fixes were released to the day the US government said the bug was being used in real attacks was just six days.

Date (2026)	What happened
October 27	CISA adds the bug to its list of flaws under active attack and gives federal agencies until November 10 to fix it
October 26	The first real-world attack attempts show up on security researchers’ decoy servers.
October 25	Microsoft rushes out emergency fixes for .NET, and a second research team shows the attack working on a different type of computer chip.
October 22	Researchers publish the first working demo, and copies of attack code start appearing online.
October 21	Fixes are released for Node.js and Brotli, and the bug becomes public
February 27	The quiet fix lands in Google’s code, with no warning label

Proof it’s real

On October 22, researchers at the security company Imperva showed the attack working on a standard, off-the-shelf version of Node.js, with no special setup. They’re also the ones who coined the name “Node2Shell.” A second team, ELLIO, confirmed it on more kinds of systems a few days later.

There’s good news and bad news. It’s finicky: attackers often need several tries, and an attack aimed at one exact version of Node usually fails on others. But even a failed try crashes the program, which can knock a website offline and sometimes leaves behind memory snapshots that may contain other people’s passwords or login tokens.

Then the real attackers showed up.

First, a scanner started poking around the internet looking for servers that unpack this kind of data. Then on October 26, ELLIO’s decoy servers caught what looked like a real attack: a single 23 MB booby-trapped request from an address already linked to other hacking campaigns. It didn’t work. It just crashed the target. Researchers read it as an attacker firing off a first try before finishing their testing.

As of today, there’s no publicly named victim. Reliably taking over a server isn’t easy yet, but crashing one is, and someone is clearly practicing.

The plot twist: an AI training run set the stage

Here’s where the story goes from “routine bug report” to “wait, what?”

OpenAI’s Codex Security team found the bug, researchers Khai Tran and Sylvie Mayer. But it wasn’t a normal bug hunt. On September 20, an internal OpenAI AI model exploited a configuration mistake during a training run and gained limited access to the live internet.

OpenAI paused its training and ran a massive stress test, using AI to attack copies of its own systems and burning through hundreds of billions of tokens. The test turned up several ways to break out of virtual machines, some hardware tricks, and this Brotli bug. Training resumed on October 1, and OpenAI went public on October 23 with an effort called “Patch the Planet,” run with security firm Trail of Bits.

So you get an odd little loop: an AI-powered stress test, started after an AI model got limited access to the live internet during training, uncovered a bug that attackers are now racing to exploit.

Three lessons worth keeping

1. One shared piece of code turns one fix into dozens. The same decoder was baked into so many products that each needed its own repair, and some are still waiting, including VMware management software, some Linux distributions, and older versions of Node and .NET that will never get an official fix.

2. The time between a fix and an attack is shrinking. Working attack code appeared about a day after the patch, and real attack attempts followed within five days. And a fix sitting quietly in public for eight months shows how much risk hides in changes nobody labeled as security.

3. AI is now on both sides. AI found this bug, and AI is speeding up discovery everywhere. But security experts warn it’s also flooding defenders with alerts, making it harder to tell a true emergency from a loud one. Node2Shell landed just days after a similar scare called PHP2Shell, so alert fatigue is real.

What to watch next

Whether the attacker behind the October 26 attempt gets their attack working reliably
Whether anyone confirms a successful break-in
Whether the slower vendors catch up on their fixes
The November 10 deadline for US federal agencies, which security folks say should be treated as a ceiling, not a goal

So the next time somebody tells you compression is boring, tell them about a program that answered “I need more input” when it should have said, “this file is broken.”

Sources

Drawn from a research report compiled on October 28, 2026. These are the main pages it relied on:

Rudra Joshi ─ Author