Node2Shell: the Node.js Brotli flaw, how to tell if it affects you and what to update

What happened, in short

• The flaw: CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. Node.js rates it high and warns that it permits remote code execution.
• The fix: released on October 21, 2026 in 22.23.4, 24.22.1 and 26.12.1. Because the decoder lives inside Node.js, updating your project dependencies is not enough: you have to update Node.js itself.
• Node.js 20 gets no patch: that line reached end of life in April 2026 and does not receive this fix. Neither do 18 or the odd-numbered lines.
• No known attacks yet: there are no reports of real exploitation, but researchers have already achieved code execution in a lab.

Fixed versions

The same update also fixes three other high-severity flaws from that week, in DNS resolution and TLS certificate checks. One more reason not to put it off.

Is my application exposed?

The flaw triggers when Node.js decompresses Brotli data crafted by an attacker. The key question is whether your application decompresses Brotli coming from someone you do not control:

• Your server accepts compressed requests. With Express 5 or body-parser 2, the middleware decompresses bodies sent with Content-Encoding: br on its own. Anyone on the internet can send one.
• Your app consumes third-party responses. Node.js's built-in fetch() accepts and decompresses Brotli responses. If you call URLs supplied by users (link previews, webhooks, scrapers) or servers you do not control, a malicious server could send you a crafted response.
• Your code uses zlib directly. zlib.brotliDecompress or createBrotliDecompress on user uploads or third-party data.
• Low risk: a server that does not decompress request bodies and only calls fetch() on your own services or trusted APIs. You still need to update, but it is not today's emergency.

How to check in 5 minutes, depending on where it runs

• Servers (EC2, Lightsail, VPS): run node -v and compare with the table. If you use nvm or several versions, check the one the service starts with, not just your user's.
• Containers (ECS, EKS, Docker): look at the base image (for example node:22-alpine) and the actual version inside the container. An image built before October 21 is still vulnerable even if it says 22: rebuild it and redeploy.
• AWS Lambda: on the managed runtimes nodejs22.x and nodejs24.x, AWS applies security patches for you unless you pinned the runtime version. nodejs20.x reached end of support on April 30, 2026: functions keep running but no longer get Node.js patches. If you use Lambda with a container image, you rebuild it yourself.
• Vercel: under Settings, Build and Deployment, Node.js Version. Vercel only offers 22.x and 24.x and applies patches for those lines on its own.

What to do, in order

1. 1. Update Node.js to 22.23.4, 24.22.1 or 26.12.1, or later, and restart the service. It is the only complete fix.
2. 2. Retire everything still on Node.js 20. Lambda functions on nodejs20.x, node:20 images and old servers: move them to 22 or 24. It is the part people forget.
3. 3. If you cannot update today, reject request bodies with Content-Encoding: br on routes that do not need them, at the load balancer, in AWS WAF or in your code. It lowers the risk, but the decoder stays vulnerable until you update.
4. 4. Watch for odd crashes. If a Node.js process restarts while decompressing data, look into it: it does not prove an attack, but it is the signal to watch.

Frequently asked questions