Analytics Story: Node2Shell

Created: 2026-10-28 Last Updated: 2026-10-28 ID: 4d0d8b78-d715-4d2e-8f2e-81c530c274bd Author: Raven Tait, Splunk Product: Splunk Enterprise Security

Description

This analytic story covers exploitation attempts and post-exploitation activity associated with Node2Shell (CVE-2026-111497), an out-of-bounds write in the Brotli decoder used by Node.js. Its detections identify large HTTP POST requests that receive server errors and Linux auditd process image changes under the same PID, which can help surface exploit attempts and command execution for investigation.

Why it matters

Node2Shell (CVE-2026-111497) is a memory corruption vulnerability in the Brotli decoder used by Node.js. Applications that process untrusted Brotli data may be at risk of exploitation, which can result in application crashes or code execution.

The detections in this story identify suspicious web request patterns and unexpected Linux process activity that may be associated with exploitation and post-exploitation behavior.

Review relevant web, application, and endpoint telemetry together. Validate affected software versions and how the application processes untrusted data, and investigate unusual process activity in the context of the host and application. Tune detections for expected application behavior and legitimate large requests.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Linux Auditd Process Image Change Under Same PID	Native API	TTP
Linux Suspicious React or Next.js Child Process	Unix Shell, Exploit Public-Facing Application	TTP
Linux Auditd Service Crash and Restart Burst	Application or System Exploitation	Anomaly
Large HTTP POST Request Resulting in Server Error	Exploit Public-Facing Application	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Linux Auditd Syscall	Linux	`auditd`	`auditd`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Zeek HTTP	Web	`zeek:http`	`http.log`

References

Source: GitHub | Version: 1