VMware Avi Load Balancer - Mitigation for CVE-2026-111497 (Node2Shell)

Products

• VMware Avi Load Balancer

Issue/Introduction

On October 21, 2026, Nodejs disclosed the following vulnerability as part of its security update:

• CVE-2026-111497 – Node.js Brotli decoder out-of-bounds write permits remote code execution.

 

VMware Avi Load Balancer is not affected by this vulnerability. Avi Load Balancer components Avi Controller and Avi Service Engine do not use nodejs packages.

This knowledge base article will be updated as more information regarding CVE-2026-111497 becomes available.

Resolution

To protect applications from CVE-2026-111497, Avi's Layer 7 HTTP policies and DataScripts can be used. Configuring Avi WAF is not required.

Perform the following operations on Avi:

Step 1: Incoming Traffic (Client → Server)

To protect servers against malicious incoming traffic, block requests with "br" in the Content-Enconding header. To reduce the risk of breaking legitimate traffic, also remove "br" from the Accept-Encoding request and response headers.

 

configure httppolicyset node2shell-client-attack-policy
 http_security_policy
  rules name rule-block-client-content-encoding-br
   index 1
   enable
   log
   match
    hdrs
     hdr Content-Encoding
     match_criteria hdr_contains
     value br
     save
    save
   action
    action http_security_action_send_response
    status_code http_local_response_status_code_403
    file
     content_type text/html
     file_content "<html><body><h1>403 Forbidden</h1><p>Content-Encoding is not allowed.</p></body></html>"
     save
    save
   save
  save
 http_request_policy
  rules name rule-strip-upstream-accept-encoding-br
   index 1
   enable
   log
   match
    hdrs
     hdr Accept-Encoding
     match_criteria hdr_contains
     value br
     save
    save
   hdr_action hdr_index 1
    action http_remove_hdr
    hdr name Accept-Encoding
     save
    save
   save
  save
 http_response_policy
  rules name rule-strip-downstream-accept-encoding-br
   index 1
   enable
   log
   match
    rsp_hdrs
     hdr Accept-Encoding
     match_criteria hdr_contains
     value br
     save
    save
   hdr_action hdr_index 1
    action http_remove_hdr
    hdr name Accept-Encoding
     save
    save
   save
  save
 save

 

The above configuration is also available in a file attached to this KB. You can either copy the above configuration snippet and paste it into a file, or download the file attached to create the HTTP policy set 'node2shell-client-attack-policy' and apply to the Virtual Service.

node2shell_incoming_configuration.cli

Applying the configuration

Use the following command on the Avi Controller CLI:

cat node2shell_incoming_configuration.cli | shell --user admin

Type the password when prompted.

 

Step 2: Outgoing Traffic (Server → Client)

Drop "br" from the Accept-Encoding header of the requests, if a server still sends br-compressed responses, do not forward them to clients, send a 503 instead.

 

configure httppolicyset node2shell-server-attack-policy
 http_request_policy
  rules name rule-strip-upstream-accept-encoding-br
   index 1
   enable
   log
   match
    hdrs
     hdr Accept-Encoding
     match_criteria hdr_contains
     value br
     save
    save
   hdr_action hdr_index 1
    action http_remove_hdr
    hdr name Accept-Encoding
     save
    save
   save
  save
 save
configure vsdatascriptset node2shell-datascript
 datascript
  evt vs_datascript_evt_http_resp
  script --
local ce = avi.http.get_header()["content-encoding"]
if type(ce) == "table" then
    ce = table.concat(ce, ",")
end
if ce and string.find(string.lower(ce), "br", 1, true) then
    avi.http.response(503, {content_type="text/plain"}, "Service Unavailable")
    return
end
END
  save
 save

 

The above configuration is also available in a file attached to this KB. You can either copy the above configuration snippet and paste it into a file, or download the file attached to create the HTTP policy set 'node2shell-server-attack-policy' & the DataScript 'node2shell-datascript' and apply to the Virtual Service.

node2shell_outgoing_configuration.cli

Applying the configuration

Use the following command on the Avi Controller CLI:

cat node2shell_outgoing_configuration.cli | shell --user admin

Type the password when prompted.

 

Additional Features

• IP Reputation: Block traffic from known malicious IP addresses by enabling the Avi IP Reputation service.

Additional Information

For any questions or further technical assistance, please reach out to the Avi Load Balancer Support team through the Broadcom support portal.

This Knowledge Base will be updated as additional information is available. 

 

References

1. https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
2. https://nvd.nist.gov/vuln/detail/cve-2026-111497

 

Revision History

Version	Date	Remarks
1.0	26-Oct-2026	Initial version