Node2Shell: Why You Should Update Node.js Now

On October 21, 2026, the Node.js team shipped security updates for every supported version. The most important fix addresses CVE-2026-111497, now widely known as "Node2Shell". The bug lives in the Brotli decoder that ships with Node.js. Crafted Brotli data can crash a Node.js process, leak memory contents and, in the worst case, run code on your server.

Node.js rates the issue as High, and a public proof of concept has been available since October 22. If you run Node.js in production, don't put this update off.

What's going on?

Brotli is a compression format used all over the web, and Node.js bundles its own copy of the Brotli library. When it receives certain malformed input, the decoder writes past the end of a buffer: a classic out-of-bounds write. That's exactly what attackers go after.

The Brotli project fixed the bug back in February 2026. But because the library is built into Node.js, the fix only reaches you with a new Node.js release. Running npm update in your project won't help.

Which versions are affected?

Other software that bundles Brotli may be affected as well. The fix is included in Brotli 1.2.1, 1.1.1 and 1.0.10. If you installed Node.js through your Linux distribution's package manager, the update may come through your distribution instead.

How can attackers reach it?

The risk exists wherever Node.js decompresses Brotli data that comes from someone else. In practice there are three common paths:

1. Incoming requests: Express 5 and body-parser 2.x automatically decompress request bodies sent with Content-Encoding: br. A plain node:http server doesn't do this on its own.
2. Outgoing requests: fetch() automatically decompresses Brotli responses, so a malicious or compromised server can attack your app through its response. Webhooks, link previews and any feature that fetches user-supplied URLs are the most exposed.
3. Direct calls: your code or a library passes untrusted data to brotliDecompress or createBrotliDecompress from node:zlib.

The second path is easy to miss. A firewall in front of your app won't help when your own server fetches the malicious response.

How serious is it?

The first public exploit only worked against a deliberately weakened test build. Shortly after, security researchers showed remote code execution against a regular, unmodified Node.js 24.22.0 Docker image on Linux arm64. It doesn't succeed every time, but it clearly works.

As of October 22, no attacks in the wild had been reported. Once an exploit is public, though, it usually doesn't take long before it's used in automated attacks.

How to check your systems

Node.js version on servers, CI runners and containers:

node --version
docker run --rm <your-image> node --version

Are you using Express 5 or body-parser 2.x?

npm ls express body-parser

Is Brotli decompressed directly anywhere?

grep -rnE "brotliDecompress|createBrotliDecompress" --include=*.js --include=*.ts .

Also take stock of where your application calls servers you don't control with fetch().

What you should do now

1. Update Node.js to 22.23.4, 24.22.1 or 26.12.1, or the latest patch release of your major version.
2. Rebuild and redeploy your Docker images. Images pinned to tags like node:24.22.0 or node:22.23.3-alpine stay vulnerable until you bump the tag.
3. Check your hosting provider. Managed platforms don't always roll out new Node.js versions right away.
4. Read your Linux distribution's security advisories if Node.js comes from a system package.
5. Start with your most exposed services: anything that accepts compressed requests or fetches external URLs.
6. Move off old versions. Node.js 20, 23 and 25 won't get a fix.

If you can't update right away

There's no official workaround. As a stopgap, you can block requests with Content-Encoding: br at your reverse proxy, load balancer or in a middleware. That only covers incoming requests, though. Brotli responses your application fetches itself remain a risk. The vulnerability is only truly closed once you've updated.

Timeline

• February 2026: fix lands in the Brotli source code
• October 21, 2026: Node.js 22.23.4, 24.22.1 and 26.12.1 are released
• October 22, 2026: proof of concept published, remote code execution against Node.js 24.22.0 confirmed

Bottom line

Node2Shell is a good reminder of how hidden these issues can be. The bug isn't in your code or in an npm package. It's in a library that Node.js itself ships with, so a regular dependency scan may not catch it. Check your Node.js versions and images today and plan your move away from outdated versions.

Not sure whether your applications are affected, or need a hand updating your containers and pipelines? Get in touch. We'll review your setup and take care of the update.

Sources: Node.js: October 2026 Security Releases · NVD: CVE-2026-111497 · Aikido Security: Node2Shell