Node2Shell (CVE-2026-111497): what the OpenWAF edge blocks and what you still have to patch

What Node2Shell is

The bug sits in DecodeBlockTypeAndLength in c/dec/decode.c of the reference Brotli library. Imperva named it Node2Shell, JFrog showed it reaches well beyond Node.js as Brotli2Shell, and the Node.js project shipped fixed releases on 21 October 2026. It has a CVSS score of 9.2. CISA added it to the Known Exploited Vulnerabilities catalog on 27 October, and Sophos reports active exploitation.

Who is affected

You are exposed in two ways:

• Servers that decode request bodies sent with Content-Encoding: br: Express 5 and body-parser 2.x on unpatched Node.js, ASP.NET Core request decompression, the ClickHouse HTTP interface, Python services that use brotli or brotlicffi, and the PHP brotli extension.
• HTTP clients that decode Brotli responses: Node.js fetch(), .NET HttpClient, and Python requests, httpx, aiohttp or urllib3 when brotli is installed. A server the attacker controls only has to answer with a crafted body.

What the OpenWAF edge does now

Shield 1009 «Brotli Request Body» refuses every request that has a body whose Content-Encoding lists br, before it reaches your origin. The header is matched in any case and anywhere in the list, including gzip, br or several Content-Encoding lines. The request gets a 403 with your block page. It has been live on every edge node since 20:52 UTC on 30 October 2026 and is on by default for every site; you don’t have to change anything.

Nothing else changes. Requests without a body and bodies encoded with gzip, deflate, zstd or identity pass as before, responses aren’t touched, and browsers never send Brotli request bodies, so visitors aren’t affected. Like every shield, 1009 blocks in active mode, only records in log mode and doesn’t run when the WAF is off.

The edge’s own Brotli decoder is a Go port with the same logic bug but no memory corruption. It has been updated too.

If your API accepts Brotli bodies

Some APIs legitimately accept Brotli-compressed bodies, such as an ingestion endpoint fed by your own agents. Patch that origin first, then add a WAF exception for rule 1009 on that path only, limited to the name that needs it. You can do it from the dashboard (Security → Firewall → Rules → WAF exceptions), the CLI, the API or the MCP add_rule tool; the advisory has the exact commands. An exception with rule_id 0 does not switch the shield off.

What the edge doesn’t cover

• Responses your code fetches. If your servers call fetch() or another HTTP client on a URL an attacker can choose, the crafted response goes straight to them.
• Traffic that skips the edge. Requests that reach your origin by its IP address or another name aren’t inspected. Accept connections only from the OpenWAF edge and use Full (strict) origin TLS.
• Names that are DNS-only, sites in log mode and sites with the WAF off.
• Other ways in: uploaded files, queues, message brokers or files in storage that your software decodes.

What to patch

We applied the same advice to ourselves and patched our own Node.js services the same day the shield went live.

How to check your logs

Refused requests appear in security events with rule_id 1009 and rule_name Brotli Request Body. In the dashboard, open Analytics → Traffic → Security events and add the filter Rule is 1009, or ask the API:

curl -s "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/events?rule_id=1009&since=2026-10-27T00:00:00Z" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

An event only tells you that someone tried through the edge. It doesn’t tell you whether your origin was reached another way, so check the origin’s own logs too.

Frequently asked questions

Sources

• Node.js: October 2026 security releases Node.js, Oct 21, 2026
• Google Brotli: fix commit 0ed4268 Google
• Known Exploited Vulnerabilities Catalog CISA
• Node2Shell: from Brotli data to remote code execution Imperva
• Brotli2Shell: beyond Node2Shell and HTTP2Shell JFrog
• Node2Shell (CVE-2026-111497) in active exploitation Sophos
• CVE-2026-111497 record CVE Program
• CVE-2026-111497 (Node2Shell): what the edge does and what you must still patch OpenWAF, Oct 30, 2026