Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder
Comments on “Node2Shell: Reproducing CVE-2026-111497 in the Node.js Brotli decoder”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Node2Shell documents CVE-2026-111497, an out-of-bounds write in the Google Brotli C decoder that affects Node.js and many runtimes and proxies built on it, including Python, Bun, Java brotli4j, .NET, Envoy, and Istio.
Why it ranked
No. 24 of 127 with a score of 0.75. The panel rated it highest on practical relevance (0.94) and technical depth (0.91), lowest on new information (0.67). The judges disagreed most on new information (spread 0.80), so the story is marked contested. Placed No. 24, No. 5 by score alone: the twelfth Security story of the day (−0.080), and close to “Broccoli2Shell: The One Decoder We All Depend On”, No. 4 on Wednesday 28 October 2026 (−0.043). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Major widely-used runtime vulnerability with exploitation confirmed, detailed technical analysis and actionable mitigation. Much overlaps with prior coverage of the same PHP and eMudhra-era security news, and it is a vendor-style write-up with some promotional Datadog content.
- AI judgeJudge 3gpt-5.6-luna
- A technically detailed vulnerability reproduction with broad runtime impact, exploitation analysis, patch guidance, and detection advice. It is highly actionable, though extensive Datadog promotion and some code-execution conclusions weaken neutrality and support.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.75total under rubric v2.3Contestedjudges differ by 0.80 on new information, 0.56 on promotional
- Significance0.79
- Reader interest0.87
- Audience breadth0.87
- Practical relevance0.94
- Substantiated0.75
- Technical depth0.91
- New information0.67
- Counts against: Promotional0.35
- Counts against: Overclaim0.39
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.76 | 0.80 | 0.82 | 0.79 | 0.07 | +0.24 | +0.190 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.82 | 0.90 | 0.90 | 0.87 | 0.08 | +0.26 | +0.227 |
| Audience breadthHow many people who build technology does it concern? | 0.97 | 0.85 | 0.80 | 0.87 | 0.17 | +0.13 | +0.114 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.97 | 0.95 | 0.90 | 0.94 | 0.07 | +0.22 | +0.207 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.66 | 0.80 | 0.78 | 0.75 | 0.14 | +0.05 | +0.037 |
| Technical depthHow technically substantive is it? | 0.99 | 0.85 | 0.90 | 0.91 | 0.14 | +0.05 | +0.046 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.82 | 0.20 | 1.00 | 0.67 | 0.80 , above the contested threshold | +0.05 | +0.034 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.14 | 0.20 | 0.70 | 0.35 | 0.56 , above the contested threshold | −0.19 | −0.066 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.38 | 0.25 | 0.55 | 0.39 | 0.30 | −0.11 | −0.043 |
| Sum of contributions | +0.745 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.745 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-30/24/"><img src="https://rubric.hrih.si/badge/2026-10-30/24.svg" alt="Ranked #24 on Rubric, 30 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 2 matches source · 3 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkDate
On October 21, 2026, Node.js released security updates for CVE-2026-111497, an out-of-bounds write in its Brotli decoder.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “On October 21, 2026, Node.js released security updates for CVE-2026-111497, an out-of-bounds write in the Brotli decoder”
The source says No passage could be compared.
Source cited by the article: nodejs.org/en/blog/vulnerability/october-2026-security-releases
Couldn’t checkNumber
The CVE record gives the flaw a CVSS v4.0 score of 9.2 (Critical), while Node.js rates its severity as High.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The CVE record gives the flaw a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2, or Critical, while Node.js rates its severity as High”
The source says No passage could be compared.
Source cited by the article: nvd.nist.gov/vuln/detail/CVE-2026-111497
Matches sourceVersion
Node.js 22.23.4, 24.22.1, and 26.12.1 contain the fix for the Brotli flaw.
The cited source says the same thing.
The article says “Node.js 22.23.4, 24.22.1, and 26.12.1 contain the fix”
The source says “Node.js v22.23.4 - Node.js v24.22.1 - Node.js v26.12.1”
Source cited by the article: nodejs.org/en/blog/vulnerability/october-2026-security-releases
Couldn’t checkFirst, only or fastest
Imperva demonstrated code execution on the official Node.js 24.22.0 Linux ARM64 image before the disclosure; the exploit needed several attempts and was not released.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Imperva demonstrated code execution on the official Node.js 24.22.0 Linux ARM64 image. Their exploit needed several attempts and was not released”
The source says No passage could be compared.
Source cited by the article: imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution
Matches sourceNumber
CISA's known exploited vulnerabilities catalog lists CVE-2026-111497, and the article states in-the-wild exploitation has been confirmed.
The cited source says the same thing.
The article says “there have been confirmed in-the-wild exploitation, and CISA's known exploited vulnerabilities catalog now lists the CVE”
The source says “Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory”
Source cited by the article: cisa.gov/known-exploited-vulnerabilities-catalog
No source givenDate
The Brotli fix was committed upstream on February 27, 2026, but fixed library releases did not ship until October 21, 2026, about eight months later.
The article gives no link or citation for it.
The article says “The fix was committed to the upstream Brotli repository on February 27, 2026, but the fixed library releases did not ship until October 21, 2026”
The source says No source to compare with.
No source givenVersion
Express 5 and body-parser 2.x accept Brotli-compressed request bodies by default, while Express 4 rejects them with HTTP 415.
The article gives no link or citation for it.
The article says “Express 5 and body-parser 2.x accept Brotli-compressed request bodies by default in their JSON, raw, text, and URL-encoded parsers”
The source says No source to compare with.
No source givenGeneralization
After measuring three obstacles, the authors assess the flaw is exploitable and the gap to reliable code execution is engineering effort.
The article gives no link or citation for it.
The article says “we assess that the flaw is exploitable and that the gap between these primitives and reliable code execution is engineering effort”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 30 Oct 2026, 05:47 UTC. It played no part in the ranking.