ELLIO Says the First In-the-Wild Node2Shell Exploit Never Reached a Shell, but Failed Brotli Attempts Crash Node.js Workers and Can Leave Another Visitor's Session in a Core Dump

NEW YORK - The first attacker that ELLIO caught trying to exploit Node2Shell in the wild built a working delivery framework and then shipped a final stage that did not work, the threat intelligence lab said in an update to its research on the Node.js flaw. ELLIO tested the attacker's payload 50 times against a vulnerable Node.js 24.22.0 server and got no shell. Every attempt still crashed the process.

That failure is not much comfort. The bug, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that Node.js bundles, and Node.js fixed it on Oct. 21 in versions 22.23.4, 24.22.1 and 26.12.1. CISA added it to its catalog of known exploited vulnerabilities on Oct. 27. The same day, Broadcom published advisory VMSA-2026-0008, saying the Node.js runtime inside VMware SDDC Manager is affected and that fixed releases are not yet available.

ELLIO, which runs a network of decoy sensors, said its sensors recorded the request at 15:08 UTC on Oct. 26. It was a single Brotli-coded body of 23,069,983 bytes built to attack one target, the official Node.js v24.22.0 build for x86-64. The delivery layer was "a straight copy of publicly available PoCs," the lab wrote, but the return-oriented programming chain that takes over the process was original, the third construction ELLIO has seen. It tried to plant its own /bin/sh string and redirect only the attacker's input, so commands would go in and nothing would come back.

The lab's verdict on that chain: "a working framework with a defective last 12 instructions." It said the pivot worked and the process crashed on each miss, but the chain never reached the call that would start a shell.

A mass exploitation operator, not a researcher

The source address, 94.154.43.7, was not new to ELLIO. The lab said it first saw the address on Dec. 15, 2025, and has recorded it active on 47 of the previous 90 days, with 25 behavior tags that include PHP2Shell exploitation, probing of Palo Alto GlobalProtect and FortiOS SSL VPN devices, and scanning of Kubernetes APIs. "This is indicative of the RCE being adopted by an operator focused on mass exploitation," ELLIO wrote.

Reconnaissance arrived first. ELLIO said a public exposure checker that identifies itself as node2shell-check/1.0, from an address in AS44620 registered in Turkey, sent 20 POST bodies marked Content-Encoding: br in two bursts about two minutes apart, mapping which hosts decompress Brotli at all. None of the 20 carried the malformed construct that triggers the bug.

ELLIO said the flaw shipped in Brotli 1.0.3 in March 2018 and that the fix was written on Feb. 27, 2026, then sat in the public master branch of google/brotli for eight months with no release and no advisory. Imperva's red team showed code execution on the official Node.js 24.22.0 arm64 image on Oct. 22. ELLIO then reproduced it on x86-64 against four targets: a plain node:http server, the official node:24.22.0-slim image running as root, Express 5.3.0 and Koa 3, each returning a shell running as the service's own account.

Where the attacker's Brotli gets in

A bare Node.js HTTP server does not decompress an incoming Brotli body by itself, so exposure depends on what hands the bytes to the decoder. ELLIO lists three paths. Express 5, body-parser 2 and Koa's body parser inflate request bodies sent with Content-Encoding: br before any route handler runs. Outbound, the built-in fetch() and clients such as axios and got decode Brotli responses automatically, which matters wherever an attacker can influence a URL the service fetches, such as link previews, webhooks and agent tools. The third path is any direct node:zlib Brotli call on client data. Akamai, in its own analysis, said its telemetry shows 61% of networks running affected Node.js versions.

The decoder also ships outside Node.js. ELLIO says Bun before 1.4.4 is affected, as are the Python Brotli and brotlicffi packages used by requests, httpx and aiohttp, and Envoy wherever its Brotli decompressor is configured. Patching Node.js fixes only the copy Node.js bundles.

One check trips up inventory scripts. Node.js applied the fix without changing the bundled version string, so process.versions.brotli reports 1.2.0 on a patched build and on a vulnerable one. ELLIO says to check the Node.js release version instead, and notes that a Dockerfile pinned to 24.22.0 keeps shipping the vulnerable build until that line changes.

Crashes are the incident

For responders, the most useful part of ELLIO's research is what happens when exploitation fails. In its lab, most of 400 attempts against Express crashed the worker instead of returning a shell. On a stock Ubuntu host, where systemd-coredump is the default, each forced crash writes a core file into /var/lib/systemd/coredump, and ELLIO says that core can hold the session cookie, bearer token and key material of whichever visitor was logged in at the moment the process died.

"Treat a run of Brotli decoder crashes as two incidents at once: availability, and disclosure wherever cores get written," the lab wrote, advising teams to limit who can read core files and how long they are kept. Containers usually write no core at all, ELLIO said, so there the harm is to availability. It also found that Python Brotli 1.2.0, brotlicffi, the PHP extension's streaming interface and the Ruby gem return nothing and never finish on the same input, which looks like a hung request rather than a failure.

Restart supervisors cut both ways. ELLIO says official Node.js builds load at fixed addresses, so the attacker must guess the heap layout, and each crash and restart hands over a fresh one. With address space layout randomization on, its lab got a shell at around the fifth attempt. "Slowing the restarts slows the attack. It does not stop it," the lab wrote. The offset is specific to each build: the value that worked on 24.22.0 produced nothing in 10,000 attempts against 22.23.3 and 26.12.0, which ELLIO expects to push attackers toward version-specific waves.

Until patches land everywhere, ELLIO recommends dropping Content-Encoding: br on inbound requests where possible, and rebuilding images, regenerating lockfiles and restarting processes across staging, CI, serverless runtimes and developer machines. Node.js 20.x, 23.x and 25.x will not receive a fix.

VMware SDDC Manager stays on workarounds

Broadcom rates the issue critical, with a CVSSv3 score of 9.8, for SDDC Manager 9.1.1, and important, at 7.5, for 9.0.x, 9.1.0 and 5.2.x. "A malicious actor with network access to SDDC Manager may exploit this issue to execute arbitrary code," the advisory says. It does not mention exploitation. For 9.1.1, knowledge base article KB460732 adds an nginx rule and a check in the UI server that reject request bodies declaring Content-Encoding: br with HTTP 415. For the older releases, KB460734 loads a preload file through NODE_OPTIONS that removes zlib.createBrotliDecompress from the UI service. Broadcom calls both temporary.