Node2Shell (CVE-2026-111497): What Node.js Teams Need to Patch and Check

What Is Node2Shell, and Is It Being Exploited?

Brotli is a compression format that browsers, CDNs and APIs use to shrink data on the way across the network. Node.js bundles its own Brotli decoder, and that decoder had a bug: it treated a malformed block switch as a temporary need for more input instead of a format error, then kept writing past the end of an eight-byte internal buffer.

The Node.js project rates it High severity. Its advisory says an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, disclosure of process memory, or remote code execution. The bug was reported by OpenAI Codex Security and fixed by Node.js maintainers.

Imperva then showed the risk was practical. Its researchers ran attacker-supplied code on the official Node.js 24.22.0 image for Linux arm64, with no debugger, though it took multiple attempts; the fixed 24.22.1 rejected the same data. As of October 22, The Hacker News reported no exploitation in the wild, but a working proof of concept means patching should not wait.

• Vulnerable software: the Brotli decoder bundled with the Node.js runtime, reached through node:zlib.
• CVE: CVE-2026-111497, rated High by the Node.js project.
• Affected lines: Node.js 22.x, 24.x and 26.x. End-of-life lines such as 20.x get no fix.
• The fix: a patched Node.js build, deployed everywhere your code runs.

Which Node.js Versions Fix Node2Shell?

Node.js published three fixed releases on October 21, 2026. A server is covered only when its Node.js version is at or above the fixed release for its own line.

Node.js 20 and older have reached end of life and will not get this fix. The Node.js project notes that end-of-life versions are always affected when a security release lands, so those apps need a move to a supported line, not a patch.

The same security release fixed nine other issues across the three lines, including two High-severity TLS hostname bypasses and a High-severity DNS bug. That is one more reason to update now, even if your app never touches Brotli.

• Node.js 26.x: 26.12.1 or later.
• Node.js 24.x: 24.22.1 or later. This is the newest LTS line.
• Node.js 22.x: 22.23.4 or later.
• Node.js 20.x and older: no fix. Upgrade to 22.x or 24.x.

Is Your App Exposed? The Ways Brotli Data Gets In

A plain Node.js HTTP server does not decode Brotli request bodies just by receiving them. The risk appears when your code, or a library it uses, decompresses Brotli data that someone else controls.

Imperva reproduced code execution through the first two paths below; the others come from the Node.js advisory and Vercel.

• Incoming requests: Express 5 body parsers, such as express.json(), express.urlencoded(), express.text() and express.raw(), decompress request bodies sent with Content-Encoding: br. Imperva reproduced code execution with Express 5.0.0 and 5.3.0, using body-parser 2.0.1 and 2.3.0. Express 4 only decompressed gzip and deflate.
• Outgoing requests: the built-in fetch() automatically decompresses Brotli responses, so a malicious or compromised server your app calls could send the crafted data.
• Custom code: any direct use of zlib.brotliDecompress(), zlib.createBrotliDecompress() or similar on data from users, uploads or third parties.
• Self-hosted Next.js: Vercel notes that Next.js image optimization does not block Brotli responses, so a self-hosted site that fetches remote images still needs the Node.js update.

npm ls express body-parser

grep -rnE "brotliDecompress|createBrotliDecompress" --include='*.js' --include='*.mjs' --include='*.cjs' --include='*.ts' --exclude-dir=node_modules .

How to Check Your Node.js Version Everywhere It Runs

Running node -v on your laptop proves very little. Check the Node.js version on every production server, inside every container image, in your CI runners, and in any serverless function setting.

Imperva warns that package inventories can miss bundled runtimes, so a clean npm audit does not mean you are patched. Check the runtime itself, and do not rely on the Brotli version: as the screenshot below shows, the vulnerable 22.22.0 and the fixed 22.23.4 both report Brotli 1.1.0.

node -v

docker run --rm --entrypoint node your-image:tag -v

npm pkg get engines.node

How to Patch Node2Shell on Your Hosting

Who installs the fix depends on where your app runs. Whatever the setup, the job is done only when the patched version is the one actually serving traffic, and every old Node.js process has been restarted or replaced.

• Vercel: projects on Node.js 22.x or 24.x do not need a settings change, because Vercel manages patch versions and is rolling the fixed builds across its runtimes. Projects on 20.x must switch to 22.x or 24.x in project settings or engines.node and redeploy.
• Other managed platforms: confirm with your provider which Node.js version it serves, and switch versions or redeploy if it is below the fixed release.
• VPS or dedicated server: install the fixed release with your version manager or package source, then restart every Node.js process, including apps run by PM2 or systemd, so nothing keeps running the old binary.
• Docker or containers: rebuild your images on a patched base image, then redeploy. A running container keeps the Node.js version it started with.
• CI and build tools: update the Node.js version in your pipeline, such as actions/setup-node, so builds and tests run on a patched runtime.

nvm install 24.22.1 && nvm alias default 24.22.1

docker build --pull -t your-image:tag .

If You Cannot Patch Today: Temporary Mitigations

The Node.js advisory lists no workaround inside Node.js itself, so treat everything below as a way to buy time. Test each change against normal traffic before relying on it.

Firewalls help, within limits. Vercel deployed rules on October 21 that block the inbound attack for every project, and Imperva added rules to its WAF. Vercel says its rules do not cover responses your functions fetch from other servers, so outbound fetch() calls still need the runtime fix.

• Turn off compressed request bodies where routes do not need them: in Express 5 and body-parser 2, the inflate: false option rejects compressed bodies instead of decompressing them.
• Block or strip Content-Encoding: br on incoming requests at your proxy or load balancer for routes that never expect it.
• Limit outgoing fetch() calls to services you trust until the runtime is patched.
• Watch for unusual Node.js process crashes and decoder errors, which can point to attack attempts, though Imperva notes neither is a reliable sign on its own.

app.use(express.json({ inflate: false }));

After the Update: Test, Then Look for Warning Signs

A patch release within the same Node.js line rarely breaks an app, but a jump from 20.x to 22.x or 24.x can. Run your test suite, then check the paths that matter most: sign-in, forms, payments, uploads and API integrations.

Then look back. The Node.js advisory says the bug can disclose process memory, so if you find credible signs of misuse, such as crashes tied to unusual compressed requests or unexpected processes, rotate the secrets your app keeps in memory: API keys, database passwords and session secrets.

• Confirm node -v on every production host and image shows a fixed release.
• Run automated tests and a manual smoke test of critical user flows.
• Review logs from October 21 onward for crashes, decoder errors and unusual compressed requests.
• If anything looks wrong, preserve logs before cleaning up, and involve your host or an incident responder.

Node2Shell vs. PHP2Shell: Same Lesson, Different Runtime

October 2026 brought two runtime-level flaws in the same week. PHP2Shell hit the PHP interpreter that WordPress runs on, and Node2Shell hit the Brotli decoder inside Node.js, which powers Next.js, Express and countless APIs.

The lesson is the same for both: the fix lives in the runtime, not in your app's packages. Many modern sites run both, for example a WordPress back end with a Next.js front end, so check both runtimes.

Your Node2Shell Action Checklist

Work through the list in order and keep a short record of what was checked, by whom and when. Your progress is saved in this browser.