# CVE-2026-111497 (Node2Shell): shield 1009 refuses Brotli request bodies

> The edge refuses requests whose body is sent with Content-Encoding br, the vector of the exploited Brotli decoder flaw. Patch your servers and clients too.

CVE-2026-111497 (Node2Shell, HTTP2Shell, Brotli2Shell) is an out-of-bounds write in Google's C Brotli decoder, fixed in Brotli 1.2.1, in the CISA Known Exploited Vulnerabilities catalog since 2026-10-27. A crafted body sent with `Content-Encoding: br` can run code on servers that decompress request bodies, such as Express 5 on unpatched Node.js.

The new [shield 1009, «Brotli Request Body»](https://developers.openwaf.dev/waf/shields/#brotli-request-body), refuses with `403` and the block page every request that has a body whose `Content-Encoding` lists `br`, before it reaches your origin. Requests without a body, other encodings and responses are unchanged. A patched origin that legitimately receives Brotli bodies can get a [WAF exception](https://developers.openwaf.dev/waf/waf-exceptions/) for `rule_id` `1009` on its path; `rule_id` `0` doesn't switch it off.

The edge doesn't cover the responses your own code fetches or traffic that reaches your origin directly. Update Node.js, Python `brotli`, PHP, .NET and `libbrotli`: see [what the edge does and what you must still patch](https://developers.openwaf.dev/waf/cve-2026-111497/).

Shield events in [security events](https://developers.openwaf.dev/analytics/security-events/) now carry the shield's id as `rule_id` (until now `0`), so you can filter them, for example by rule `1009`.