This text was generated using artificial intelligence (AI).Status: October 23, 2026, 10:30 AM CEST – Updates are available, a proof of concept is public. No active exploitation was reported until October 22, 2026. However, anyone running Node.js applications should update now.
Node2Shell is a critical security vulnerability in Node.js identified by the CVE-2026-111497. It is located in the Brotli decoder that Node.js includes for decompressing compressed data. Crafted Brotli data can overwrite memory and, in the worst case, execute code without the need for attackers to log in. The vulnerability is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026.
The name Node2Shell comes from an analysis by the security provider Imperva. In the assessment, there are two interpretations: The Node.js project classifies the vulnerability as „High“ (high) . The CVE entry awarded by Google, the publisher of the Brotli library, rates it with CVSS 9.2 according to CVSS v4.0 („Critical“, critical).
Proof of Concept: public, code execution demonstrated only in the lab; active exploitation not reported until October 22
Patch available since: 10/21/2026
Official workaround: none
Timeline: What has happened so far
October 21, 2026: Node.js releases security updates for all supported version lines with a total of ten security fixes. On the same day, Brotli versions 1.2.1, 1.1.1, and 1.0.10 are released, and Vercel activates firewall rules for incoming requests. According to the Node.js advisory, the vulnerability was reported by OpenAI Codex Security. The PHP project also closes the critical vulnerabilities on the same day around PHP2Shell; OpenAI Codex Security was also involved in its discovery.
October 22, 2026: The CVE entry is published (CVSS 9.2). Imperva demonstrates code execution against the official Node.js 24.22.0 image. A separate proof of concept is made public, but achieves code execution only on an intentionally weakened test build. Bun closes the vulnerability with version 1.4.4.
Which software is affected by Node2Shell?
The vulnerability lies in Node.js itself, specifically in the Brotli library that Node.js includes. Updating individual npm packages does not close it. It depends on the Node.js runtime environment and, for Node.js from distribution packages, on their Brotli package.
An application is at risk if it unpacks Brotli-compressed data from an untrusted source. The main vectors are:
Incoming requests with Express 5 or body-parser 2.x: These versions automatically unpack request bodies with Content-Encoding: br . Imperva has verified code execution with Express 5.0.0 and 5.3.0, as well as body-parser 2.0.0 to 2.3.0; not every minor version has been tested individually.
Outgoing requests with fetch(): The built-in Node.js function automatically unpacks Brotli responses. A server controlled by attackers or compromised can reach the application this way. Typical cases are webhooks, link previews, and functions where users specify a URL.
Direct use of node:zlib: Applications and libraries that unpack Brotli data from an insecure source with brotliDecompress or createBrotliDecompress .
A simple HTTP server with the Node.js module http It does not unpack incoming Brotli bodies by itself. It is affected nonetheless as soon as the application uses one of the mentioned paths.
Other software that embeds the Brotli decoder in versions 1.0.3 to 1.2.0 and unpacks data from an insecure source can also be affected. The JavaScript runtime Bun was affected up to version 1.4.3.
Node2Shell Exploit: What Attackers Can Achieve
Execute code: According to the CVE entry, attackers can corrupt the decoder's memory and potentially execute arbitrary code without logging in through a crafted Brotli data stream. The code then runs in the context of the Node.js process.
Reading memory: The disclosure of memory contents of the process is also possible according to the CVE entry.
Taking down service: At a minimum, a crash of the process through a crafted input is possible.
Imperva demonstrated code execution against the official Linux-arm64 image of Node.js 24.22.0 without a debugger and without altered programs, both via fetch() and via request bodies in Express. The attack did not succeed in every attempt. Node.js 24.22.1 rejected the same inputs. A separate, public proof of concept achieved code execution according to The Hacker News only on a deliberately weakened test build; on a normal build, it resulted in a crash and limited reading of process memory.
Active exploitation had not been reported until October 22, 2026. The CVSS vector also indicates prerequisites for the attack. Practically, this means: the application must unpack Brotli data from an insecure source.
Finding affected Node.js systems in the inventory
Anyone wanting to patch quickly must first know where Node.js is running at all. The runtime is often found in places that do not appear in any server inventory: in Docker images, CI runners, serverless functions, internal tools, build servers, and appliances with embedded runtime.
How do I check the Node.js version?
On the server: node –version shows the installed version. If an application runs with its own binary (for example via nvm or in a subdirectory), that version must be checked.
In Docker: docker run –rm node –version. An image fixed to an old version like node:24.22.0 remains vulnerable even if it is rebuilt. The tag must point to a patched version.
In the code: npm ls express body-parser shows whether Express 5 or body-parser 2.x is in use. A search for brotliDecompress and createBrotliDecompress direct Brotli usage in your own code and dependencies.
From the outside: Express applications often reveal themselves through the HTTP header X-Powered-By: Express. The absence of the header does not mean that no Node.js is running.
Node.js from Linux packages
The official Node.js binaries and official Docker images come with their own Brotli copy; there, the Node.js update closes the gap. Distributions like Debian build Node.js against the system's Brotli library instead. There, the fix comes through the distribution's Brotli package, even for older Node.js lines like 18.x and 20.x, which Debian still delivers. The Debian Security Tracker lists brotli (bookworm, trixie, forky, sid) and the dependent nodejspackages as vulnerable on October 23, 2026, with no fix recorded yet. For other distributions, their respective advisory applies.
Closing the Node.js security vulnerability: What to do now
On Update to Node.js 22.23.4, 24.22.1 or 26.12.1 or newer, including on CI runners and build servers.
Switch Docker images to a patched tag and rebuild; redeploy applications with embedded Node.js binaries.
For Node.js from distribution packages, update the distribution's Brotli package as soon as it is available.
Update Bun to version 1.4.4 or newer.
Node.js 25.x, 23.x, 20.x and older from official sources: These lines have reached their end-of-life and will no longer receive updates from the Node.js project. Migrate affected applications to a supported version.
After the update, restart all Node.js processes, for example, through the process manager or by restarting the containers.
Inquire with hosted platforms and service providers whether the runtime environment has already been updated.
Transitional measures when the update is not yet possible
The Node.js advisory does not mention a workaround. However, certain attack vectors can be mitigated until the update:
Deny requests with Content-Encoding: br at the reverse proxy, load balancer, or in the middleware if the application does not require Brotli-compressed request bodies. This only protects incoming requests.
Temporarily disable functions that fetch data from external or user-specified servers, or discard responses with fetch() from such servers. Content-Encoding: br von solchen Servern verwerfen.
Web Application Firewalls: Individual providers have published rules, such as Vercel for incoming requests on its platform. Brotli responses that an application retrieves from other servers do not cover such rules.
None of these measures replace updating the runtime environment.
How do I recognize an attack?
Reliable indicators of attacks do not currently exist. The researchers mention the following as indications for prioritization:
unexpected crashes of Node.js processes while unpacking data,
error messages from the Brotli decoder in the logs.
Both are not considered conclusive evidence of exploitation by their assessment. Anyone finding signs of compromise should assume that credentials, tokens, and keys may be affected in the process and should replace them.
Further vulnerabilities in the same Node.js update
The security release from October 21 includes nine vulnerabilities in addition to Node2Shell, three of which are also rated as „High“:
CVE-2026-105482:dns.resolve truncates hostnames that contain a NUL character.
CVE-2026-105483: Bypassing the TLS hostname check for IP addresses in full-width digits.
CVE-2026-106069: Bypassing the TLS hostname check when the hostname is generously resolved to an IP address.
In addition, there are three vulnerabilities rated „Medium“, including repeated random values from crypto.randomUUID() in startup snapshots and single executable applications, and three rated „Low“, including two bypasses of the permission model. Furthermore, the release updates OpenSSL, c-ares, and undici, among others.
DACH and EU Context
Timely application of security updates is one of the risk management measures according to Art. 21 of the NIS-2 Directive for organizations in the application area of NIS-2. If a significant security incident occurs due to an exploitation of Node2Shell, the reporting obligations under Art. 23 of the NIS-2 Directive apply, in Germany according to § 32 BSIG. In Austria and Switzerland, the respective national reporting obligations apply.
How LocateRisk Addresses Exposed Assets
LocateRisk makes externally accessible systems and software that can be detected from the outside visible. In the case of Node2Shell, this helps to find publicly accessible web applications and externally detectable Node.js installations, including those not listed in any internal inventory, and to prioritize the update sequence. An automated Security Rating. With Preemptive Intelligence, LocateRisk reports critical software versions as soon as a vulnerability is known, even before the NVD officially categorizes it.
LocateRisk does not replace patch management and makes no statements about whether a vulnerable Node.js version is running on a detected system or if the application unpacks Brotli data. Internal services and applications that retrieve data from foreign servers are not covered by the external view. For this, internal inventory and cross-referencing with the Node.js advisory or package status of the distribution are necessary. fetch() All Node.js versions prior to those mentioned in the table above, as well as the end-of-life lines 25.x, 23.x, 20.x, and older, are affected. Anyone wanting to know if Node.js is visible in their own externally accessible infrastructure can use the.
For outsourced web applications or customer portals, vendor risk management can additionally help document feedback from service providers regarding the patch status.
Am I affected?
Node.js: CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
Node2Shell is the name under which the Node.js security vulnerability CVE-2026-111497 is discussed. It is a memory error in the Brotli decoder, where writing occurs beyond the boundaries of a buffer (Out-of-Bounds-Write). Crafted Brotli-compressed data can corrupt memory and, in the worst case, execute code.
Yes, in the lab. Imperva has demonstrated code execution against the official Node.js-24.22.0 image on Linux arm64. A separate proof of concept is public but achieves code execution only on an intentionally weakened test build. No active exploitation had been reported by October 22, 2026.
The Node.js project rates it as high, while Google's CVE entry assesses it as critical with CVSS 9.2. The prioritization mainly depends on whether an application unpacks Brotli data from an insecure source, such as via Express 5 or fetch().
Node.js 22.23.4, 24.22.1 and 26.12.1, released on October 21, 2026, as well as the Brotli library in versions 1.0.10, 1.1.1 and 1.2.1. Bun is protected starting from version 1.4.4.
Possibly. In addition to Express 5 and body-parser 2.x, the built-in fetch() leads to the vulnerability because it automatically unpacks Brotli responses. Libraries that node:zlib use can also process Brotli data. Therefore, updating the runtime environment is the right step in any case.
Deny requests with Content-Encoding: br Reject at the proxy or middleware and temporarily restrict functions that retrieve data from foreign servers. There is no official workaround, and proxy and WAF rules do not help against Brotli responses to one's own requests.
Initial points of contact are the security advisory from the Node.js project, the CVE entry, and the technical analysis by Imperva. If you do not operate Node.js yourself, such as with hosting platforms or service providers, you should contact the provider directly and inquire about the patch status.
As of October 23, 2026. This contribution serves general informational purposes and does not constitute legal, security, or action advice in individual cases. The IT security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we accept no liability for the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-111497
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français