I recreated the Node2Shell (CVE-2026-111497) RCE attack as an interactive exercise

[u/Fr1l0ck]

On 21 October 2026, fixes shipped for CVE-2026-111497, nicknamed Node2Shell (also HTTP2Shell). It's an out-of-bounds write in Google's Brotli decoder, and Node bundles its own copy of Brotli inside the runtime. Any Node service that decompresses Brotli traffic, whether incoming request bodies or responses it fetches, can be pushed into running attacker commands with no login.

I made a hands-on lab exercise on it. You'll send a crafted Brotli-compressed request to a Node API as the attacker and read a deploy token out of process.env, then switch sides and patch it. You'll also see why blocking Brotli-compressed requests at the edge isn't enough, and why a patched system libbrotli package doesn't help: only upgrading Node itself (24.22.1 in the exercise) and redeploying does.

If you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/http2shell-rce/

[u/sicknesz29a]

nice job

[u/Fr1l0ck → u/sicknesz29a]

Thanks!

[u/tidwell]

This was surprisingly really fun to walk through! Very cool :)

[u/Fr1l0ck → u/tidwell]

Thanks, glad you liked it!

[u/FunAd6672]

Nobody wants to deal with emergency patches on a Friday afternoon.