Critical Node.js Vulnerability CVE-2026-111497 ("Node2Shell" Brotli RCE) & October 2026 Security Patch Guide

Executive Summary: What Is CVE-2026-111497 ("Node2Shell")?

Hard on the heels of the recent PHP core runtime advisories, a major global security alert has been issued for every engineering team running Node.js servers, APIs, microservices, and full-stack web applications. On October 21, 2026, the OpenJS Foundation and the official Node.js Project released emergency security updates patching 10 vulnerabilities across all supported runtime branches. At the center of the disclosure is CVE-2026-111497—tracked across the cybersecurity community as "Node2Shell".

Scored at 9.2 (Critical) on CVSS v4.0 by Google’s CNA and rated High Severity by the Node.js security team, CVE-2026-111497 is an out-of-bounds memory write flaw inside the Brotli compression decoder bundled directly inside the Node.js runtime. By sending a specially crafted, malformed Brotli stream to an exposed Node.js process, an unauthenticated remote attacker can write past allocated memory buffers—leading to process crashes, sensitive memory disclosure, or pre-authentication Remote Code Execution (RCE).

Why "Node2Shell" (CVE-2026-111497) Impacts So Many Modern Web Apps

Node.js is the backbone of modern scalable backend architectures and full-stack JavaScript frameworks, including Express.js, NestJS, Next.js, React Server Components, and Angular SSR. Unlike third-party npm package bugs or CMS plugin flaws such as the GiveWP WordPress Plugin Security Vulnerability, CVE-2026-111497 sits inside the native C/C++ Google Brotli library (versions 1.0.3 through 1.2.0) compiled directly into the node binary.

Your Node.js infrastructure is exposed whenever the runtime decompresses untrusted Brotli data across any of these three common paths:

• 1. Inbound HTTP Requests & API Payloads: Backend servers using Express, Fastify, or custom middleware that accept Content-Encoding: br on incoming POST/PUT requests and decompress request bodies automatically.
• 2. Native fetch() and Outbound HTTP Clients (The Hidden Vector): Even if your application never explicitly imports node:zlib, Node.js’s built-in fetch() (powered by Undici) automatically advertises Accept-Encoding: br and decompresses Brotli responses. If your server fetches data from user-supplied URLs, webhooks, third-party APIs, or untrusted upstreams, a malicious response can trigger CVE-2026-111497 completely bypassing inbound Web Application Firewalls (WAFs).
• 3. Direct node:zlib Stream Processing: Applications calling zlib.brotliDecompress(), zlib.brotliDecompressSync(), or zlib.createBrotliDecompress() on user-uploaded files, message queues, or streaming pipelines.

All 10 Vulnerabilities Fixed in the October 2026 Node.js Security Release

While CVE-2026-111497 captures the headlines due to its Remote Code Execution impact, the October 21, 2026 security release resolves nine additional vulnerabilities—including three other High-Severity network and TLS bypass flaws—plus critical upstream dependency updates:

High-Severity Vulnerabilities

• CVE-2026-111497 (High / CVSS 9.2 — Affects 22.x, 24.x, 26.x): Node.js Brotli decoder out-of-bounds write permitting Remote Code Execution ("Node2Shell").
• CVE-2026-105482 (High — Affects 22.x, 24.x, 26.x): dns.resolve() improperly truncates domain names containing NUL characters, enabling DNS resolution manipulation and potential SSRF bypasses.
• CVE-2026-105483 (High — Affects 24.x, 26.x): TLS certificate hostname verification bypass when an IP address is formatted using Unicode fullwidth digits.
• CVE-2026-106069 (High — Affects 22.x, 24.x, 26.x): TLS certificate hostname verification bypass when a target host loosely resolves to an IP address, allowing Man-in-the-Middle (MitM) spoofing.

Medium & Low-Severity Vulnerabilities

• CVE-2026-105481 (Medium — Affects 22.x, 24.x, 26.x): HTTP keep-alive socket flaw where Node.js processes a response written to the socket before the client request was sent (HTTP response smuggling/desync risk).
• CVE-2026-106072 (Medium — Affects 22.x, 24.x, 26.x): Improper TLS certificate validation for non-canonical IPv4 hostnames allowing DNS Subject Alternative Names (SANs) to authenticate IP endpoints.
• CVE-2026-106074 (Medium — Affects 22.x, 24.x, 26.x): Predictable cryptography flaw where crypto.randomUUID() and crypto.randomInt() entropy caches are saved into user-land startup snapshots and Single Executable Applications (SEAs), causing spawned processes to repeat identical "random" values.
• CVE-2026-106070 (Low — Affects 26.x): ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation.
• CVE-2026-106071 (Low — Affects 26.x): Permission Model filesystem over-grant via wildcard radix lookup.
• CVE-2026-106073 (Low — Affects 22.x, 24.x, 26.x): Permission Model bypass via fs.realpathSync.

Additional Bundled Security Updates: The October 2026 patches also update Undici, c-ares, OpenSSL (on 22.x and 24.x), SQLite (on 22.x), and revoke untrusted root certificates following the eMudhra Intermediate CA compromise.

Affected Node.js Versions vs. Official Patched Releases

Because CVE-2026-111497 and its companion flaws reside inside the core Node.js binary, running npm audit fix will not resolve them. You must upgrade the Node.js runtime itself to the official patched releases published on October 21, 2026:

• Node.js 26.x (Current Branch): All versions prior to 26.12.1 are vulnerable. Upgrade immediately to Node.js v26.12.1.
• Node.js 24.x (Active LTS Branch): All versions prior to 24.22.1 are vulnerable. Upgrade immediately to Node.js v24.22.1 (LTS).
• Node.js 22.x (Maintenance LTS Branch): All versions prior to 22.23.4 are vulnerable. Upgrade immediately to Node.js v22.23.4 (LTS).

Critical Warning for End-of-Life (EOL) Node.js 20.x, 18.x, and 16.x Servers: Node.js 20 reached official End-of-Life on April 30, 2026. The Node.js Project is NOT releasing security patches for Node.js 20, Node.js 18, or older versions, even though they bundle the vulnerable Brotli decoder. Organizations running legacy Node.js 18 or 20 workloads in production remain permanently exposed to CVE-2026-111497 unless they migrate to Node.js 22 LTS or 24 LTS.

Running production applications on End-of-Life Node.js 18 or 20, or worried that upgrading will break your live Next.js, React, Angular, or Express backend? Contact our senior engineering team at Ideate Web Solutions for an immediate dependency audit and zero-downtime Node.js upgrade.

How to Check If Your Server & Codebase Are Exposed

DevOps and backend teams should audit both their active runtime binaries and their codebase for Brotli decompression entry points:

• Check Active Runtime Version: Run node -v across every host, VM, CI/CD runner, and Kubernetes pod. Remember that updating a package manager does not replace an already running Node.js process in memory until PM2, systemd, or Docker containers are restarted.
• Scan Code for Direct Brotli Calls: Search your repository using ripgrep or grep: rg -n --glob '!node_modules/**' 'brotliDecompress|createBrotliDecompress|content-encoding' .
• Audit Express & Middleware Stack: Run npm ls express body-parser compression undici to identify HTTP parsers and clients handling compressed streams.

Step-by-Step Remediation & Emergency Mitigation Guide

Step 1: Upgrade the Node.js Runtime & Redeploy Containers

Upgrading the Node.js binary is the only complete remediation for all 10 CVEs:

• Using NVM / fnm: Run nvm install 24.22.1 --reinstall-packages-from=24 (or 22.23.4 / 26.12.1) and restart your process manager via pm2 restart all --update-env.
• Using Docker / Kubernetes: Update your Dockerfile base images to node:24.22.1-alpine, node:24.22.1-slim, or node:22.23.4-alpine, rebuild all container artifacts, and perform a rolling restart of all pods.
• Rebuild Single Executable Applications (SEAs): If you use V8 startup snapshots or SEAs, you must regenerate them on the patched runtime to eliminate the predictable UUID/randomness vulnerability (CVE-2026-106074).

Step 2: Temporary Mitigations (If You Cannot Upgrade Immediately)

If legacy dependencies prevent an immediate runtime upgrade from Node.js 20 or an older minor release, reduce your attack surface for CVE-2026-111497 immediately:

• Block Inbound Brotli Payloads at the Reverse Proxy / WAF: Configure NGINX, Envoy, AWS ALB, or Cloudflare WAF rules to reject incoming HTTP requests containing the header Content-Encoding: br before they reach your Node.js upstream.
• Disable Automatic Request Decompression in Express: If using body-parser on internal routes that do not require compressed uploads, set inflate: false in your parser configuration, or restrict accepted encodings strictly to gzip.
• Override Accept-Encoding on Outbound fetch() Calls: When calling untrusted external URLs or user webhooks via fetch(), explicitly pass headers: { 'Accept-Encoding': 'gzip, deflate' } so the upstream server does not return a Brotli-encoded payload to Node’s vulnerable decoder.

Frequently Asked Questions (FAQ) About the Node.js "Node2Shell" Vulnerability

1. What is the difference between Node2Shell (CVE-2026-111497) and PHP2Shell?

While both were disclosed in October 2026 and carry a 9.2 CVSS v4.0 score, PHP2Shell (CVE-2026-109618 & CVE-2026-109619) targets memory management in the core PHP engine, whereas Node2Shell (CVE-2026-111497) is an out-of-bounds write inside the Brotli decompression library bundled with Node.js. Any Node.js application that decompresses untrusted Brotli input—either via incoming requests, node:zlib, or outbound fetch() responses—is vulnerable to Remote Code Execution.

2. Which Node.js versions fix CVE-2026-111497?

The vulnerability is patched in Node.js 26.12.1 (Current), Node.js 24.22.1 (LTS), and Node.js 22.23.4 (LTS). Node.js 20.x, 18.x, and older versions are End-of-Life and will not receive official patches from the Node.js Project.

3. Are Next.js, React, Angular, and Express.js applications affected by CVE-2026-111497?

Static frontend builds served purely via CDN are not affected at runtime. However, Next.js Server-Side Rendering (SSR) / API routes, React Server Components, Angular Universal/SSR servers, and Express.js backends running on unpatched Node.js 22.x, 24.x, 26.x (or EOL Node 18/20) runtimes are directly affected and must have their underlying Node.js server binary updated.

4. Can a Web Application Firewall (WAF) completely block Node2Shell?

No. While a WAF can block incoming client requests with Content-Encoding: br, it cannot inspect outbound responses fetched by your Node.js server using built-in fetch() or undici. Upgrading the Node.js runtime is mandatory for complete protection.

Facing This Node.js Vulnerability? Contact Ideate Web Solutions for Immediate Assistance

Are your production APIs, SaaS dashboards, or e-commerce platforms running on an unpatched Node.js server—or stuck on End-of-Life Node.js 18 or Node.js 20 where upgrading risks breaking legacy dependencies? Do not leave your infrastructure exposed to memory corruption and Remote Code Execution attacks.

With over 14+ years of full-stack engineering experience across Node, React, Next, Angular, React Native, Ionic, Laravel, and Core PHP, our senior development team at Ideate Web Solutions helps businesses worldwide harden, migrate, and scale their web architectures:

• Emergency Node.js 22 LTS & 24 LTS Security Patching: Rapid, zero-downtime runtime updates, Docker container rebuilding, and reverse-proxy hardening.
• Legacy Node.js 16 / 18 / 20 Migration & Code Refactoring: Safe migration of outdated Node.js backends, custom React, Next.js, and Angular web applications, and REST/GraphQL APIs to actively supported LTS branches without breaking live functionality.
• Full-Stack Security Audits & Ongoing Maintenance: Comprehensive vulnerability scanning, TLS/SSL remediation, and proactive server maintenance across your entire stack.

Secure your Node.js infrastructure today! Click here to Contact Us, email our engineering team directly at [email protected] for priority security support.