Node2Shell: Is Your Node.js App Affected by the Brotli Vulnerability? (CVE-2026-111497)
23 October 2026 · By Ethan Fernandes
A flaw in how Node.js decompresses Brotli data could let attackers run code on servers and apps. Who's affected, the fixed versions, and how to check and update your Node.js apps.
Quick answer
Update Node.js to a fixed version: 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and older are end of life and won't be fixed, so move them to a supported line. Apps that fetch content from user-supplied URLs or accept compressed requests are the most exposed to CVE-2026-111497.
On 21 October 2026, Node.js released security updates for a serious flaw in its Brotli decoder, the code that unpacks Brotli-compressed data. Tracked as CVE-2026-111497 and nicknamed "Node2Shell", it's an out-of-bounds memory write that Node.js classes as a remote code execution risk: in the right conditions, an attacker could run commands with the permissions of your Node.js app.
Node.js runs a lot of modern websites, web apps, APIs and internal tools. If a developer built you a custom app, client portal or modern website in the last few years, there's a fair chance it uses Node.js.
The short version: update Node.js to a fixed version: 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and older are end of life and won't be fixed, so move them to a supported version. Apps that fetch content from other websites, or accept compressed uploads or requests, are the most exposed.
Who Is Affected?
All supported Node.js lines before the fixed releases are affected. The vulnerable decoder can be reached in two main ways:
- Your app fetches content from other websites. Node.js's built-in fetch automatically decompresses Brotli responses, so an app that fetches a URL a user supplies, such as a link preview, scraper, website checker or webhook, could receive a malicious response.
- Your app accepts compressed requests. Some frameworks and middleware decompress incoming request bodies automatically.
- Your code uses Node's zlib Brotli functions directly, such as brotliDecompress or createBrotliDecompress.
Fixed Versions
| Node.js line | Fixed version |
|---|---|
| 26.x | 26.12.1 |
| 24.x | 24.22.1 |
| 22.x | 22.23.4 |
| 20.x and older | End of life, no fix: upgrade to 22, 24 or 26 |
If Node.js was installed from a Linux distribution's packages, check your distribution's advisory too. Some builds use the system's Brotli library, which needs its own update.
How to Check and Fix It
- Find your Node.js version. Run node -v on the server, or check the "engines" field in package.json, a .nvmrc file, your Dockerfile or your hosting dashboard.
- On Vercel, Netlify and similar platforms, the runtime is set by your project settings or package.json. Pin a supported line, for example "engines": { "node": "24.x" }, redeploy, and check your host's security advisory for when the patched runtime is available.
- On your own servers and containers, update Node.js, rebuild container images, and restart the app.
- Update dependencies with a non-breaking npm audit fix, then run your build and tests.
- Review where your app handles untrusted data: user-supplied URLs, uploads and webhooks.
What About PHP?
PHP had two critical flaws fixed the same day, affecting a huge number of WordPress and traditional websites. See our guide: Is my website running PHP, and how do I fix it?
Want Us to Check Your Apps?
We've already checked and updated our own systems and the sites we manage. If you have a website or app built on Node.js and you're not sure who looks after it, we can find the version, update it safely, check your dependencies and confirm it still works. Get in touch and we'll reply within a few hours.
Sources
- The Hacker News: Node.js Brotli decoder bug could allow remote code execution
- Vercel: Node.js security advisory
- Qualys: Find vulnerable Node.js runtimes
Common questions
Node.js 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end of life and won't receive a fix, so upgrade to a supported line.
Run node -v on the server, or check package.json's engines field, a .nvmrc file, your Dockerfile or your hosting platform's project settings.
Server-side code on these platforms runs on Node.js, so pin a supported Node.js line, redeploy and check your host's advisory for when the patched runtime is available. Purely static pages without server code are much less exposed.
Fetching content from URLs that users supply, accepting compressed requests, or decompressing Brotli data directly. Node.js's fetch decompresses Brotli responses automatically.
Not sure which of these you actually need?
Our free IT health check shows where your business is exposed and what to fix first. It takes a few minutes, with no sales pitch.
Get IT tips in your inbox
Practical advice for small businesses. No spam.