Critical Severity
CVE-2026-111497
Published: Nov 7, 2026
CVE-2026-111497 - Node.js Brotli OOB Write Pre-Auth RCE (Node2Shell) | CVSS 4.0: 9.2 | PoC + Full Exploit | By Gh0st-Bx1
<div align="center">
# Node2Shell - CVE-2026-111497
[](https://nvd.nist.gov/vuln/detail/CVE-2026-111497)
```
_ _ _ ____ ____ _ _ _
| \ | | ___ __| | ___|___ \/ ___|| |__ ___| | |
| \| |/ _ \ / _` |/ _ \ __) \___ \| '_ \ / _ \ | |
| |\ | (_) | (_| | __// __/ ___) | | | | __/ | |
|_| \_|\___/ \__,_|\___|_____|____/|_| |_|\___|_|_|
CVE-2026-111497 - Node.js Brotli OOB Write (Node2Shell)
CVSS 4.0: 9.2 (CRITICAL) | CWE-787 + CWE-252 | Pre-Auth RCE
By Gh0st-Bx1 | https://github.com/Ghost-Bx1
```
> Pre-Auth RCE via Brotli OOB Write in Node.js - Affects Express 5 + body-parser 2.x, fetch()/undici, zlib API
</div>
---
> **LEGAL NOTICE:** This repository was created exclusively for educational purposes and security research. Use of these tools against systems without prior written authorization is illegal. The author is not responsible for misuse.
---
## Summary
| Field | Detail |
|-------|--------|
| CVE | CVE-2026-111497 |
| Alias | Node2Shell |
| Type | Out-of-Bounds Write (CWE-787) + Unchecked Return Value (CWE-252) |
| CVSS 4.0 | 9.2 (CRITICAL) |
| Component | Google Brotli `c/dec/decode.c` - `DecodeBlockTypeAndLength()` |
| Vectors | Express 5 + body-parser 2.x / Node.js fetch() + undici / zlib.brotliDecompress() |
| Authentication | Not required (pre-auth) |
| Disclosure | October 21, 2026 - Imperva Threat Research / Vercel |
| Status | Patches available |
---
## Vulnerability Description
### Root Cause
The vulnerability is in `DecodeB