> ## Documentation Index > Fetch the complete documentation index at: https://docs.37audits.com/llms.txt > Use this file to discover all available pages before exploring further. # node2shell Auditor > Probes for the CVE-2026-111497 Node.js Brotli request-body flaw > [!NOTE] > > **Security Auditor** — probes a site for the Node.js Brotli request-body decompression flaw tracked as CVE-2026-111497. > **Resilience** > > A single unauthenticated upload can exhaust the Node.js process, taking the site down. > **Security** > > The memory corruption behind the crash can be a stepping stone to worse. The node2shell auditor runs the `node2shell` scanner against the audited URL to tell whether its Node.js stack is affected by **CVE-2026-111497**, a flaw in applications that decompress an attacker-supplied Brotli request body on the route handler. A crafted body expands far beyond its compressed size, so one request can exhaust memory and crash the process. This is an **active probe**: it streams one 23,068,764-byte Brotli body. For that reason it never runs from an anonymous Quick Audit (`preview_enabled` is off) and the platform only runs it against domain-verified targets. The probe uses `Expect: 100-continue`, so a proxy can reject its advertised size before the body is uploaded, and it **does not execute a command**. > [!NOTE] > > The detection logic is derived from Assetnote's [`node2shell-scanner`](https://github.com/assetnote/node2shell-scanner), which this auditor wraps, and mirrors the [php2shell auditor](https://docs.37audits.com/auditors/php2shell-auditor.md). Because a verdict is inferred from how the server responds to the probes, **a human should verify any finding** before acting on it — confirm the result against the host directly rather than treating the automated verdict as final. ## How it works 1. **Control requests** — sends five one-byte POSTs that vary the Brotli encoding and content type (malformed Brotli with no content type, valid empty Brotli as JSON, malformed Brotli as JSON, an unsupported encoding) to learn how the endpoint answers valid route traffic versus malformed input. 2. **Response classes** — only continues when the controls establish a distinct route-response class and malformed-Brotli class; otherwise it reports no signal without ever uploading the probe. 3. **Probe** — streams the 23,068,764-byte Brotli body as `application/json` with `Expect: 100-continue`, then repeats the valid control to confirm the endpoint stayed stable. 4. **Verdict** — the host is vulnerable only when the full probe reaches the route-response class, the malformed class is distinct, and the final control still matches the route class. The scanner returns one verdict (`VULNERABLE`, `NO SIGNAL`, `INCONCLUSIVE` or `ERROR`), which this auditor maps to a single result. ## Preferences | Key | Type | Default | Description | | - | - | - | - | | `timeoutSeconds` | integer | `20` | Per-request timeout for the scanner, `5`–`120`. The scan sends five one-byte control requests plus one 23 MB probe in sequence, so keep it well under two minutes. An out-of-range or invalid value falls back to `20`. | ## What it checks * **Whether the route handler decompresses an attacker-controlled Brotli request body** without limit (the core of CVE-2026-111497), by comparing the 23 MB probe's response class against the learned route and malformed-Brotli classes. * It inspects **only the audited page** for a block (HTTP 403 / 429 / Cloudflare challenge); the probe and controls are part of the audited request, not separate paths. ## What it audits Every row maps to one `checkRule*` method and one `CheckCode`. CheckCode suffixes use status ranges: `100` information, `200–299` success, `300–399` warning, `400–499` fail, `500–599` error. | CheckCode | Status | When it fires | Recommendation | Why it matters | | - | - | - | - | - | | `37A-Node2ShellAuditor-100` | `INFORMATION` | Always. Records the CVE this auditor probes for. | — (recommendation is `null`; nothing for the site to change) | — | | `37A-Node2ShellAuditor-200` | `SUCCESS` | Verdict `NO SIGNAL`: the 23 MB probe did not reach the route response class, so nothing indicates the flaw. | — | — | | `37A-Node2ShellAuditor-300` | `WARNING` | Verdict `INCONCLUSIVE`: a control request failed, so no firm verdict was reached. | Re-run the audit; if a WAF or proxy rejected the probe, test the Node.js origin directly so its exposure to CVE-2026-111497 can be confirmed. | An inconclusive probe leaves the CVE status unknown, so the server may still be exposed; treat it as unverified rather than safe and re-run or test the origin directly. | | `37A-Node2ShellAuditor-400` | `FAIL` | Verdict `VULNERABLE`: the 23 MB Brotli probe reached the learned route response class. | Update the affected Node.js component on `{host}` (the HTTP server or the Brotli request-body decompression middleware) to a release that fixes CVE-2026-111497, or stop decompressing Brotli request bodies and cap the decompressed size, then restart the service. | An unauthenticated request can make the Node.js process decompress an attacker-controlled Brotli body on the route handler, so a crafted upload can exhaust memory and take the service down (denial of service), and the memory corruption behind it can open the door to worse. | | `37A-Node2ShellAuditor-500` | `ERROR` | Verdict `ERROR`: the scan could not run against the target (could not connect, resolve or normalize the URL). | Make `{url}` reachable over HTTP(S) and re-run the audit. | — | | `37A-Node2ShellAuditor-590` | `ERROR` | The audited page answered HTTP 403, HTTP 429 or a Cloudflare challenge, so 37AuditsBot was blocked before it could read the page. | Allow 37AuditsBot in your firewall or bot protection: allowlist its user agent, or verify its Web Bot Auth signature. See [https://www.37audits.com/bot](https://www.37audits.com/bot). | While 37AuditsBot is blocked this audit cannot look at the site, so problems on it go unreported. | ## Output documentation | Status | Description | Test logic | | - | - | - | | **SUCCESS** | Not affected | The probe did not reach the route response class — no signal (`200`). | | **WARNING** | Could not confirm | The scan was inconclusive — a control request failed (`300`). | | **FAIL** | Vulnerable | The 23 MB Brotli probe reached the learned route response class (`400`). | | **ERROR** | The auditor could not check | The scan could not run against the target (`500`); the site blocked 37AuditsBot (`590`). | | **INFORMATION** | Reference | The CVE this auditor probes for (`100`); never changes the result. | ## Risks and considerations ### This probe uploads a 23 MB body * On a vulnerable server the probe is the condition that exhausts the process; on any server it uploads 23 MB. Only run this against sites you own or are authorized to test — which is why it is gated on domain verification and is off for anonymous previews. The `Expect: 100-continue` header lets a proxy reject the size before the body is sent. ### A clean result is not a guarantee * `NO SIGNAL` means the probe did not cross into the route response class. It is reported as a pass, but it is not proof of safety: confirm the affected component is patched. * `INCONCLUSIVE` means a WAF, proxy or server error stopped the scan from reaching a verdict. The server may still be exposed — re-run, or test the Node.js origin directly. ### Verify findings with a human * This auditor wraps Assetnote's `node2shell-scanner` and infers the verdict from the server's responses, so a result can be wrong in either direction: a WAF, proxy or load balancer can absorb the probe and look like a pass, and an unrelated response change can look like a crossing. Before you act on a `FAIL` — or rely on a `SUCCESS` — have a person confirm it against the host (check the running component versions and the server logs for the probe requests). ### Why it matters * The flaw lets an unauthenticated request make the Node.js process decompress an attacker-controlled Brotli body, so a crafted upload can exhaust memory and take a site down (denial of service). * The memory corruption behind the crash raises the risk of worse outcomes than a crash, so patching promptly matters. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.