Node2Shell: the Node.js Brotli flaw and how to patch it

On 21 October 2026 Node.js shipped a security release that fixes, among other things, a flaw in the code that unpacks Brotli-compressed data. Node.js says an attacker who can feed malformed Brotli data to an application can corrupt its memory, which can lead to a crash, a leak of what's in memory, or remote code execution. It's tracked as CVE-2026-111497, and some security firms have nicknamed it Node2Shell.

You may never have heard of Node.js, but there's a fair chance something your organisation relies on runs on it. It powers a large share of modern web apps, APIs, customer portals and internal tools, and plenty of the software developers build for small and mid-sized businesses. The fix is a routine runtime update. The hard part is knowing where Node.js is.

How it works

Brotli is a compression format, the same idea as a zip file, used to make web traffic smaller. Node.js ships its own copy of the Brotli decoder in its built-in node:zlib module.

The bug is in how that decoder handles a particular kind of malformed input. Instead of rejecting the data as broken, it treated it as "wait for more", and kept appending bytes to a small internal buffer of eight bytes until it wrote past the end. Writing past the end of a buffer is the classic way attackers get from "send some data" to "run some code".

So the question for any Node.js application is simple: does it ever decompress Brotli data that someone outside could have supplied? An API that accepts compressed uploads or request bodies, a service that fetches and unpacks content from other servers, or a library that does either on the app's behalf could all qualify. Your developers will know, or can find out.

How worried should you be?

Node.js rates it high, not critical, and the risk depends on whether untrusted Brotli data ever reaches the decoder. It wasn't in CISA's Known Exploited Vulnerabilities catalogue as of the catalogue's 23 October update, and Node.js's advisory doesn't mention attacks.

We'd still patch it this week. Internet-facing services that decompress data from outside are the most direct path to remote code execution, and the same release fixes three other high-severity issues: a DNS lookup flaw and two ways to slip past TLS certificate hostname checks. An app that never touches Brotli still benefits from the update.

Are you affected?

The flaw affects the three supported release lines. The fixed versions are:

• Node.js 26.12.1
• Node.js 24.22.1
• Node.js 22.23.4

Every other release line is end of life, including Node.js 25, 23, 21, 20 and anything older. Node.js says end-of-life versions are always affected when it publishes a security release, and they won't get a fix, so they need moving to a supported line.

Node.js often hides in places nobody thinks of as "a server":

• Your website or portal, if it was built with a JavaScript framework and runs on your own server or virtual machine.
• Container images. A Docker image built from a node base image months ago still has the Node.js version it was built with, however recently the app itself changed.
• Hosted platforms that supply Node.js for you. Whether you need to redeploy depends on the provider, so check its notices.
• Products that bundle their own copy of Node.js, such as some appliances, desktop apps and single-file executables. Those need an update from the vendor.

On any machine where you can open a terminal, node --version tells you the version in use. Your developers can tell you which version each app and image is built on.

How to fix it

1. List where Node.js runs: servers, virtual machines, container images, build pipelines, and anything a developer or software vendor runs for you.
2. Update each one to 26.12.1, 24.22.1 or 22.23.4, or later on the same line, then restart the application. A running process keeps using the old code until it restarts.
3. Rebuild container images from an updated base image and redeploy them. Updating the server underneath a container doesn't update the Node.js inside it.
4. Plan the move off unsupported lines (25, 23, 21, 20 and older). That's real work for your developers, because code and libraries may need testing on the newer version, but an end-of-life runtime will keep collecting unfixed flaws like this one.
5. Ask your vendors. For any product or service built on Node.js that you don't run yourself, ask the vendor in writing whether they're affected and when they patched.

Node.js hasn't published a workaround. Qualys suggests interim steps while you patch: avoid decompressing untrusted Brotli data where you can, and limit compressed payload sizes and decompression ratios at your reverse proxy or web application firewall. Those narrow the exposure; they don't replace the update.

If you think it already happened

The likely signs are crashes and restarts of a Node.js service with no obvious cause, followed by unexpected activity from the account the app runs as: new files, new processes, or connections out to addresses you don't recognise. If you see that, isolate the service, keep its logs and assume anything it had access to (database passwords, API keys, cloud credentials) needs changing.

Report a compromise to ASD's ACSC at cyber.gov.au (opens in a new tab). Most businesses choose "Cybercrime", which covers hacked devices, systems and accounts; "Cyber security incident" is only for organisations with 250 or more staff or $250 million turnover, government departments, critical infrastructure and regulated entities. Or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), 24 hours a day. If personal information could have been accessed, check your obligations under the Notifiable Data Breaches scheme.

The same week brought critical flaws in PHP as well. If you run websites, read what PHP2Shell means for your website too.

Where Geidi fits

Geidi's cyber security services are aligned to the Essential Eight, ISO/IEC 27001 and SMB1001, and backed by a 24/7 security operations centre. If you'd like help working out where Node.js runs in your business, or getting a vendor to answer the question, get in touch.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases (opens in a new tab)
• Node.js: release index (versions and security flags) (opens in a new tab)
• Node.js: Release schedule (opens in a new tab)
• Qualys: Node.js patches Brotli remote code execution flaw (23 October 2026) (opens in a new tab)
• Hadrian: Node2Shell: What we know about the Node.js Brotli RCE (CVE-2026-111497) (opens in a new tab)
• CISA: Known Exploited Vulnerabilities catalogue (opens in a new tab)
• ASD's ACSC: Submit a report (opens in a new tab)
• OAIC: About the Notifiable Data Breaches scheme (opens in a new tab)