node2shell: How to Check If Your Node.js App Is Exposed and Patch It

node2shell is the nickname for CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js. The Node.js project fixed it on 21 October 2026, and the fix is a runtime upgrade. Here's how to check and patch, based on the advisories listed at the end.

What node2shell is

The Node.js security release describes an out-of-bounds write in the bundled Brotli decoder. If an attacker can supply Brotli data that your app decompresses with node:zlib, they can corrupt process memory. Node.js says this can lead to a crash, memory disclosure or remote code execution. It affects the 22.x, 24.x and 26.x lines, and Node.js credits OpenAI Codex Security with reporting it.

Severity ratings differ by source:

• The Node.js advisory rates it high.
• The CVE record gives it 9.2 (critical) on CVSS 4.0 and places the root bug in Google's Brotli library, versions 1.0.3 through 1.2.0.
• Singapore's Cyber Security Agency calls it critical, citing a CVSS 3.1 score of 9.8.

Imperva's Red Team says it got code execution against the official Node.js 24.22.0 image, through both the built-in fetch() and Express 5 / body-parser 2 request parsers. It says 24.22.1 rejected the same input.

Where http2shell fits in

http2shell is not a second bug. Aikido Security uses the name for the same CVE now that it is known to reach beyond Node.js. It lists fixes for Python's Brotli and brotlicffi packages, libbrotli, curl/libcurl, Bun, Envoy and Istio. On 23 October, Aikido said patches were not yet available for every affected service.

Am I exposed?

Vercel's advisory explains that Node.js doesn't decode Brotli by itself. Your app is exposed when your code or a library decompresses attacker-controlled Brotli data. That data can come in a request body or in a response your app fetches.

1. Check the runtime version.

node -v

The fixed versions are 22.23.4, 24.22.1 and 26.12.1 (or newer in the same line). Anything older in those lines is affected. Node.js 20 is end-of-life and won't get a fix, according to Vercel.

2. Look for paths that decode Brotli. Imperva's tests found Express 5 and body-parser 2 decode Brotli request bodies when their parsers are configured:

npm ls express body-parser

Also look for fetch() calls to servers you don't control and direct zlib Brotli use (brotliDecompress).

3. Check containers and CI, not just your laptop. Imperva warns that a package inventory can miss an older Node binary inside a container image:

docker run --rm your-image:tag node -v

How to patch

With nvm:

nvm install 24
nvm use 24
node -v   # should print v24.22.1 or newer

For Docker, rebuild on a base image with a fixed Node version and redeploy. For distro packages, Aikido notes vendors may backport the fix without changing the version number, so check your distribution's security notice.

On a managed platform, check the provider's notice. Vercel says it manages patch versions for 22.x and 24.x, but projects on 20.x must move to 22.x or 24.x and redeploy.

Python and Bun users get their own fixes, per Aikido:

pip show Brotli brotlicffi
pip install -U "Brotli>=1.2.1"      # or "brotlicffi>=1.2.1.0"
bun --version                        # 1.4.4 or later is fixed

Aikido notes that requests, httpx and aiohttp use these packages automatically when installed, and that pip-audit and Dependabot weren't flagging it as of 23 October, so check by hand.

If you can't upgrade today

Vercel and Imperva both added WAF rules, but both say that doesn't replace patching. A WAF also can't see Brotli responses your app fetches from other servers. As a stopgap, Aikido suggests rejecting requests whose Content-Encoding includes br before any decoder runs. For outbound traffic, it suggests disabling or rejecting Brotli response decoding.

Sources

• Node.js: Wednesday, October 21, 2026 Security Releases
• CVE.org: CVE-2026-111497
• Cyber Security Agency of Singapore: Critical Vulnerability in Node.js (AL-2026-154)
• Vercel: Node.js security advisory, Brotli decoder RCE
• Imperva: Node2Shell, From Brotli Data to Remote Code Execution
• Aikido Security: Node2Shell evolves to HTTP2Shell

For more research-based AI and tech news, see AI News by AIFix at ainews.useaifix.com, and useaifix.com for help keeping sites and workflows in shape.