Node2Shell (CVE-2026-111497): what Node.js teams need to patch

On 21 October 2026 Node.js shipped security releases for 22.x, 24.x and 26.x. The headline fix is CVE-2026-111497, a flaw in the Brotli decompression code bundled with Node.js, now nicknamed Node2Shell. With crafted input, an attacker may be able to crash a Node.js process, read its memory or, in some cases, run code. This guide covers what it is, who is exposed and how to patch. It is general information based on the Node.js advisory.

What is Node2Shell?

Brotli is the compression format behind Content-Encoding: br, and Node.js includes a Brotli decoder in node:zlib. According to the Node.js advisory, malformed Brotli data could make the streaming decoder keep writing past the end of a small internal buffer. Node.js rates the issue High; Google, which assigned the CVE, scores it 9.2 on CVSS v4.

The same Brotli decoder code is used outside Node.js, so other runtimes and libraries that bundle it have shipped their own fixes. That is why you will also see the names Broccoli2Shell and HTTP2Shell.

Which Node.js versions fix it?

• Node.js 22 (LTS): 22.23.4
• Node.js 24 (LTS): 24.22.1
• Node.js 26 (Current): 26.12.1
• End-of-life lines (for example 18, 20, 23, 25): No fix. Node.js says end-of-life versions are always affected when a security release happens; move to a supported line.

The same release also fixes several other issues, including two TLS hostname-verification bypasses rated High, so the update is worth doing even if you never touch Brotli.

Who is exposed?

Node.js says the risk is to applications that decompress Brotli data with node:zlib when the input can be controlled by an attacker. In practice, look for:

• APIs that accept compressed request bodies, for example middleware that decodes Content-Encoding: br uploads before your route handler runs.
• Services that fetch URLs supplied by users (link previews, webhooks, scrapers, image proxies) and automatically decompress the responses.
• File and message processing that unpacks Brotli-compressed data received from outside: uploads, queues, partner feeds.

A plain website that only sends Brotli-compressed responses to browsers is much less exposed, but the Node.js runtime should still be updated. Updating an npm package does not fix this: the vulnerable code ships inside Node.js itself, so you need a patched Node.js build.

How to check and patch

1. Find every Node.js runtime you run. Run node -v on servers and in CI, and check the FROM node:… lines in Dockerfiles, .nvmrc files, the engines field in package.json, CI workflow settings and hosting dashboards (for example the Node.js selector on cPanel/CloudLinux hosts, or the runtime setting for serverless functions).
2. Upgrade to 22.23.4, 24.22.1 or 26.12.1 (or newer on the same line). Pin the patch version in Docker images instead of a floating tag you never rebuild.
3. Rebuild and redeploy. A patched base image only helps after the container is rebuilt and the app restarted.
4. Move off end-of-life Node.js. If anything still runs Node 20 or older, plan the upgrade now; there will be no fix for it.
5. Check other runtimes and libraries that bundle Brotli, for example Bun and Python's Brotli packages, which have their own advisories. Your dependency scanner or platform's security page will list what applies to you.

On managed platforms (serverless functions, platform-as-a-service hosts), the provider updates the runtime, but often only when you redeploy or select the newer version. Check your provider's status or security page and redeploy.

Running Node.js or Next.js apps and want a second pair of eyes on your upgrade? Talk to Dzimark — we maintain and upgrade web apps for businesses in the USA, UK, Canada and Australia.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases
• Node.js release schedule