Security Advisory: Critical “Node2Shell” Brotli Decoder Out-of-Bounds Write (CVE-2026-111497) — How Virtue IT Checked & Patched Our Servers and Client cPanel Sites

1. Executive Summary

On 21–22 October 2026, coordinated security releases shipped across Node.js, Bun, and the Python and Google Brotli projects for CVE-2026-111497 — a critical out-of-bounds write vulnerability in the Brotli decompression decoder (c/dec/decode.c) tracked in the security community as "Node2Shell".

GitHub's advisory database rates the flaw CVSS v4.0 9.2 (Critical). A remote, unauthenticated attacker who can get a vulnerable application to decompress a crafted Brotli stream can corrupt adjacent decoder memory — leaking sensitive memory contents, crashing the process, or potentially executing arbitrary code. Red Hat scores it 8.1 (Important) under CVSS v3, noting exploitation requires a malformed stream and that no reliable public remote-code-execution proof-of-concept exists — but the affected library sits underneath an enormous range of everyday software, and a WAF cannot mitigate it.

2. Technical Breakdown: Why This Reaches Ordinary Traffic

Brotli is the compression algorithm behind Content-Encoding: br on HTTPS responses. The flaw lives in the decoder's block-type switch handling: the low-level DecodeBlockTypeAndLength function overloaded one return value to mean both "invalid stream" and "needs more input", so callers treated a malformed block switch as recoverable — producing an out-of-bounds write inside the decoding process.

• It triggers on decompress, not compress: any application that downloads or accepts Brotli-compressed data it did not create can be hit — a Node.js fetch() against a malicious or compromised server automatically decodes Content-Encoding: br, as do the node:zlib brotliDecompress APIs, DecompressionStream, and equivalent Python calls.
• Affected versions: Google Brotli 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1); Node.js below 22.23.4, 24.22.1 and 26.12.1; Bun below 1.4.4; and Python Brotli/brotlicffi packages before their patched releases.
• Bundled copies stay vulnerable: executables and containers built with bun build --compile, pkg-style bundlers, or vendored Brotli libraries carry their own decoder and remain exposed until rebuilt against a fixed version.
• WordPress plugins cannot stop this: like this month's PHP2Shell flaws, the bug sits below application code in a system-level library — protection has to happen at the server and package layer.

3. How Virtue IT Checked and Patched Our Servers and Client cPanel Sites

If your business website or application is hosted with Virtue IT — on our Australian cPanel / CloudLinux platform or our TTVPS / OpenLiteSpeed VPS infrastructure — this is already handled and no action is required on your part.

1. Fleet-wide component audit: immediately after the 21–22 October disclosures we inventoried every managed node for vulnerable Brotli copies — operating-system libbrotli packages, the web server's Brotli compression module, CloudLinux Node.js Selector runtimes, and any Python or Node application environments running inside client accounts.
2. Vendor patched packages deployed: CloudLinux and cPanel backported updates and upstream fixed builds (Brotli 1.0.10 / 1.1.1 / 1.2.1; Node.js 22.23.4 / 24.22.1 / 26.12.1) were applied across the shared hosting fleet and TTVPS nodes, followed by full web-server and application worker restarts.
3. Per-site client checks: each client cPanel account was reviewed for self-managed Node.js apps, Python virtualenvs shipping the Brotli/brotlicffi packages, and static builds bundling their own decoder — flagged items were updated or confirmed patched as required.
4. Verification: installed versions were confirmed against the fixed release lines, and no managed server is left running a decoder inside the affected 1.0.3–1.2.0 range.

4. Recommended Actions for Businesses Hosted Elsewhere

If you run self-managed hosting, a VPS without a managed patching cycle, or applications maintained by an agency that does not touch server internals, verify the following:

1. Node.js: update to 22.23.4, 24.22.1 or 26.12.1 (or later) — and rebuild anything packaged with --compile/pkg-style bundlers, since they embed the runtime.
2. System Brotli: update libbrotli/brotli packages to 1.0.10, 1.1.1 or 1.2.1 via your distribution or CloudLinux/cPanel update channels, then restart web and application workers.
3. Python and other runtimes: upgrade the Brotli/brotlicffi wheels in every virtualenv and rebuild containers; update Bun to 1.4.4 or later.
4. Reduce exposure meanwhile: where your stack allows it, stop auto-decoding Content-Encoding: br from untrusted servers and peers until the decoder is patched.