An affected platform is visible and its version is older than the fix.
CVE-2026-111497 · CVSS 9.2 Critical · Node2Shell / HTTP2Shell
Is your server exposed to Node2Shell?
A critical out-of-bounds write in the Brotli decoder bundled in Node.js, Bun, Envoy, .NET and Python. If your app decompresses attacker-controlled Brotli data, it may be exploitable for remote code execution.
✓ Detection only
✓ Never sends the exploit
⚡ Behavioral + version check
- 5
- runtimes affected
- br
- request-body decode path
- 0
- payloads executed
Scan a target
What the verdict means
Two questions that actually matter for triage: is an affected runtime behind the fix, and is the Brotli code path even reachable?
The server decompresses Brotli request bodies but the version is hidden — update unless you know it's patched.
An affected platform is present, the version is hidden, and the body probe was inconclusive.
The visible version already includes the fix.
No affected platform was observed from outside.
⚠ A WAF/CDN that strips Content-Encoding: br can mask the probe, so a
clean result does not prove the runtime behind it is patched. Always confirm the actual version.
Fixed versions
| Software | First fixed release |
|---|
Prefer to run it yourself?
The scanner is a single, dependency-free Python file and the full lab is open source.
github.com/RedSideSecurity/node2shell ↗$ python3 n2s_scan.py -u https://your-api.example.com/route --probe
[VULNERABLE] https://your-api.example.com/route Node.js 24.22.0 [VULN]