Node2Shell Patch Guide: Fix This 9.2 Node.js Flaw Before It Bites

The Node2Shell patch is out, and you should apply it this week. Node.js shipped fixes on October 21 for a Brotli bug, tracked as CVE-2026-111497, that can crash a server, leak memory, or in some cases let an attacker run code. Updating to 22.23.4, 24.22.1 or 26.12.1 closes it.

Here is the short version before the details:

• Flaw: an out-of-bounds write in the Brotli decoder bundled inside Node.js.
• Severity: 9.2 on the CVSS 4.0 scale, according to HeroDevs.
• Affected: the 22.x, 24.x and 26.x lines before the fixed releases, plus older end-of-life lines.
• Fix: upgrade, rebuild your container images, and restart your processes.

What the Node2Shell flaw actually does

Brotli is a compression format that web servers and browsers use to shrink responses. Node.js ships its own Brotli decoder, and that decoder can write past the end of a memory buffer when it reads a specially crafted stream.

The result depends on the target. HeroDevs lists three outcomes: a crash that kills in-flight requests, a memory leak, and code execution as the user running Node.js. The attacker doesn’t need to log in.

Has anyone used it yet? A public proof of concept appeared on October 22. HeroDevs says it only reached code execution on a deliberately weakened test build, and showed a crash and limited memory read on a normal one.

HeroDevs also says Imperva’s Red Team reported code execution on the official Node.js 24.22.0 arm64 Linux image, though not on every attempt. HeroDevs found no exploitation in the wild and no CISA Known Exploited Vulnerabilities listing as of October 23. Keep in mind HeroDevs sells extended support, so read its urgency with that in mind.

Which Node.js versions have a fix

Only three release lines got patches. Check your line against this table.

If you run an end-of-life version, there is no official fix. You need to jump to 22, 24 or 26.

This release also fixes nine other CVEs, according to the Konfirmity advisory summary. They include TLS hostname-check bypasses and a DNS name truncation bug. That is one more reason to take the whole update, not just the Brotli fix.

How to check if your app is exposed

Start with the version. Run node --version on every server and inside every container image, then compare it to the table above.

Being on an old version isn’t enough to be hit, because the attacker’s Brotli data has to reach the decoder. HeroDevs names three common paths:

• The node:zlib Brotli functions, if your code decompresses Brotli data.
• The built-in fetch(), when a server replies with Content-Encoding: br.
• Body-parsing middleware, such as Express 5 with body-parser 2.x.

Services that accept uploads or fetch user-supplied URLs are the best place to look first. They are the easiest for a stranger to feed bad data to.

Node2Shell patch steps for today

Updating the package on your laptop isn’t the finish line. Many teams ship Node.js inside Docker images or compiled single-file executables, and those keep the old runtime until you rebuild them.

So the order is simple. Upgrade to a fixed release, rebuild every image and executable that embeds Node.js, then restart the running processes.

If you can’t upgrade right away, one stop-gap helps. Aikido’s write-up suggests rejecting requests with a br Content-Encoding at your proxy or load balancer. It also warns that just editing outgoing Accept-Encoding headers is not enough on its own.

For a similar patch-now situation, see our guides on the PHP2Shell flaws and the malicious LiteLLM release.

It isn’t only Node.js: Python, Bun and Envoy too

The bug lives in Google’s Brotli library, so other software that bundles it is affected. Aikido has tracked the spread and calls it HTTP2Shell. Here are the fixed versions it lists.

Python HTTP libraries such as urllib3, requests, httpx and aiohttp pick up Brotli automatically when it’s installed. Aikido also notes that pip-audit, Dependabot and Safety may not flag vulnerable Python versions yet, so check by hand.

Frequently Asked Questions

What is Node2Shell?

It’s the nickname for CVE-2026-111497, a memory bug in the Brotli decoder bundled with Node.js. Crafted compressed data can crash a server, leak memory, or possibly run attacker code.

Which Node.js version fixes Node2Shell?

Use 22.23.4, 24.22.1 or 26.12.1, or any newer release in the same line. Node.js 25, 23, 21, 20 and older get no official fix.

Is Node2Shell being exploited right now?

HeroDevs reported no exploitation in the wild as of October 23, but a public proof of concept exists. Treat it as urgent rather than waiting for attacks to start.

Do I need to rebuild my Docker images?

Yes, if the image bundles Node.js. The old runtime stays inside the image until you rebuild and redeploy it.

Our take: patch first, audit second

If you run Node.js on anything public-facing, update today and rebuild your images before you start digging into who might have been targeted. The fix is a routine version bump, and the risk of waiting is a crash or worse. Once that’s done, spend ten minutes checking Python services and proxies, because that’s where this bug will quietly linger.