Node2Shell (CVE-2026-111497): RedSide Security Releases Open-Source Scanner and Docker Lab

RedSide Security has released an open-source Node2Shell security scanner and a hands-on Docker laboratory, providing cybersecurity professionals with practical tools to investigate potential exposure to CVE-2026-111497, a critical vulnerability affecting Brotli decompression across multiple runtimes.

The vulnerability, known as Node2Shell, carries a CVSS score of 9.2 (Critical) and affects the Brotli decoder used by Node.js, Bun, Envoy, .NET, and Python.

Under certain conditions, processing attacker-controlled compressed data could result in unauthenticated remote code execution (RCE).

Rather than publishing another vulnerability summary, RedSide Security developed a practical, open-source toolkit designed to help security teams identify potential exposure, validate detection methods, and better understand the vulnerability.

What Is Node2Shell?

Node2Shell (CVE-2026-111497) is a critical vulnerability associated with the processing of Brotli-compressed data.

Brotli is a compression algorithm widely used by web servers, application runtimes, reverse proxies, and other software components to reduce data transfer sizes.

The vulnerability becomes relevant when an affected implementation processes specially crafted, attacker-controlled compressed data.

Depending on the deployment and processing conditions, exploitation could potentially lead to remote code execution without authentication.

The affected technology ecosystem includes:

  • Node.js
  • Bun
  • Envoy
  • .NET
  • Python

However, the presence of Brotli support does not automatically mean a particular server or application is vulnerable. Actual exposure depends on the runtime, implementation, version, and how compressed input is processed.

Introducing RedSide Security's Open-Source Node2Shell Toolkit

To support practical vulnerability assessment and security research, RedSide Security developed and open-sourced a Node2Shell testing toolkit.

The project includes three main components.

1. Detection-Only Vulnerability Scanner

The scanner is designed to identify potential Node2Shell exposure without executing the vulnerability's exploitation payload.

Its detection-focused approach helps security engineers assess systems while avoiding deliberate remote code execution.

Key capabilities include:

  • Identifying potential exposure to CVE-2026-111497
  • Examining server responses to Brotli-compressed data
  • Supporting non-destructive security assessments
  • Providing a lightweight implementation for security workflows

2. Hands-On Docker Laboratory

The project includes a Docker-based testing environment designed to demonstrate different Node2Shell detection scenarios.

The laboratory contains three target configurations:

Target Purpose
Vulnerable Demonstrates behavior associated with an affected implementation
Patched Provides a reference for testing against a fixed implementation
Version-hidden Helps evaluate detection when software version information is unavailable

This environment allows security researchers and penetration testers to compare scanner results across different conditions without relying on production systems.

The laboratory is also suitable for internal security training and testing detection logic.

3. Behavior-Based Detection

A central design goal of the Node2Shell scanner is to avoid relying exclusively on software version information.

Version-based checks can be useful, but they have limitations.

For example, web servers may hide version information, reverse proxies may alter responses, and containerized environments can introduce additional complexity.

Instead, the scanner evaluates how a target processes Brotli-compressed data.

This behavior-based approach is intended to provide additional evidence when version information is unavailable or insufficient.

Importantly, behavioral indicators should be interpreted as potential exposure rather than definitive proof of exploitability.

Lightweight Python Implementation

The Node2Shell scanner is written in Python and uses no external Python dependencies.

This reduces installation complexity and makes the project easier to incorporate into existing security workflows.

Potential use cases include:

  • Authorized penetration testing
  • Web application security assessments
  • Security research laboratories
  • Vulnerability management workflows
  • DevSecOps and CI pipelines
  • Internal security training

The toolkit is designed to be accessible to both security researchers and engineering teams responsible for maintaining internet-facing infrastructure.

Testing Across Different Server Environments

During development, RedSide Security tested the scanner against different server configurations and network environments.

Testing scenarios included:

  • Direct application server connections
  • HTTP redirects
  • Content Delivery Network (CDN) environments
  • Servers exposing different response characteristics

These tests helped improve the scanner's detection logic and reduce reliance on basic software fingerprinting.

The project aims to make detection more useful in environments where infrastructure components may obscure the underlying application runtime.

Online Scanner and GitHub Repository

RedSide Security provides two ways to access the project.

Online Node2Shell Scanner

For users who prefer a browser-based interface, an online scanner is available:

node2shell.redside.io

Open-Source GitHub Repository

Security professionals who prefer to run the scanner locally, inspect the source code, or use the Docker laboratory can access the GitHub project:

github.com/RedSideSecurity/node2shell

The open-source release allows the cybersecurity community to review the implementation, reproduce testing scenarios, and contribute improvements.

Detection Is Not a Substitute for Patching

Although vulnerability scanning can help identify potentially affected systems, it should not replace software updates.

Organizations should:

  1. Identify applications and services that process Brotli-compressed data.
  2. Review affected runtime versions and vendor security advisories.
  3. Update vulnerable components to patched releases.
  4. Rebuild and redeploy container images containing affected dependencies.
  5. Verify that production workloads are using updated components.
  6. Use authorized security testing to assess potential exposure.

Brotli support alone is not evidence that a server is vulnerable, and a negative scanner result should not be treated as a guarantee that a system is secure.

Open Source and Community Contributions

The Node2Shell project was developed by RedSide Security, a cybersecurity company based in Yerevan, Armenia.

The goal is to provide practical security tooling that helps engineers move beyond vulnerability headlines and investigate real-world exposure.

RedSide Security welcomes community feedback, bug reports, technical suggestions, and contributions.

GitHub: https://github.com/RedSideSecurity/node2shell

Online Scanner: https://node2shell.redsidesecurity.com

Contact: [email protected]

Conclusion

Node2Shell (CVE-2026-111497) highlights the security risks associated with vulnerabilities in widely used decompression components.

With the release of its open-source detection scanner and Docker-based laboratory, RedSide Security provides cybersecurity professionals with tools for evaluating potential exposure and studying vulnerability detection in realistic environments.

The project combines non-destructive scanning, behavior-based checks, and reproducible testing scenarios to support security research, penetration testing, and defensive operations.

The toolkit is intended exclusively for authorized security testing. Keeping affected software updated remains the primary defense.

Developed by RedSide Security — Yerevan, Armenia.