21 October 2026 was a busy day for anyone running web servers. First PHP shipped emergency fixes for PHP2Shell, then Node.js released its own critical security update. The Node.js bug is CVE-2026-111497, which some people online call Node2Shell. That’s a nickname, not an official name.
We didn’t find this bug. Security researchers did. We run servers, so here’s what it is, how to tell whether you’re affected, and how we patched a real server step by step.
Watch the video
The full explanation plus the live check and patch on an Ubuntu 26.04 server:
What is the bug?
CVE-2026-111497 is rated 9.2 out of 10 (critical). It isn’t in your code. It’s in Brotli, the compression format from Google that’s built into Node.js. Websites use Brotli to make data smaller, a bit like a zip file.
Inside the Brotli decoder there’s a tiny buffer, only 8 bytes. If you send it a broken Brotli stream, the decoder should say “this data is bad, stop”. Instead it says “I need more data” and keeps copying bytes past the end of that 8-byte box, over memory that belongs to something else. That’s an out-of-bounds write. It can crash the server or leak memory, and in the worst case it lets an attacker run their own code.
Who is affected?
- Node.js 22, 24 and 26 before the fixed versions. Node.js 20 and older get no fix at all.
- Apps that unpack Brotli data from someone else. For example, Express 5 apps, because
express.json()unpacks Brotli request bodies by default. - Server-side
fetch(), which unpacks Brotli responses automatically. - No login is needed. The bug has been in Brotli itself since around 2018, so other software that uses Brotli needs updates too. That part grew into a bigger story we cover in HTTP2Shell.
Live check: is a real server exposed?
We built a small test API on Ubuntu 26.04 in a QEMU virtual machine. node --version says v24.22.0. The fix for Node 24 is 24.22.1, so this server is vulnerable. Look at the order of the code: step 1 unpacks the body, step 2 logs it, and only step 3 checks the login.
express.json() runs before the login check.Next we play a stranger with no login. We compress a normal order with Brotli and send it with curl. The server answers 401, login required, so it looks like we were blocked. The log tells a different story: the body was already unpacked. The Brotli decoder runs for anyone on the internet, before the login check. A malicious stream instead of our normal one is where the bug hits. We didn’t send one.
Who found it?
The Node.js advisory credits OpenAI Codex Security, an AI security tool, with researchers Khai Tran and Sylvie Mayer. The fix came out on 21 October. Proof-of-concept code appeared on GitHub within hours, and the CVE was published the next day.
Update, 4 November: things have moved since our video. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on 27 October, so it’s now officially treated as exploited in the wild. If you haven’t patched yet, do it now.
How to fix it
Update Node.js. The fixed versions are:
| Node.js line | Fixed in |
|---|---|
| 22 | 22.23.4 |
| 24 | 24.22.1 |
| 26 | 26.12.1 |
| 20 and older | No fix. Move to 22 or newer |
Using nvm, NodeSource or Docker? Install the fixed version the way you normally do (for example nvm install 24.22.1, or rebuild your image on a fixed node: tag). Our test server uses the official build from nodejs.org, so we downloaded it and checked the SHA-256 checksum before using it:
cd ~/node
wget https://nodejs.org/dist/v24.22.1/node-v24.22.1-linux-x64.tar.xz
wget https://nodejs.org/dist/v24.22.1/SHASUMS256.txt
grep linux-x64.tar.xz SHASUMS256.txt | sha256sum -c -
# node-v24.22.1-linux-x64.tar.xz: OK
The step people miss: restart the process
After switching to the new version, node --version says 24.22.1. But the server that was already running still uses the old binary in memory. Check what the running process actually uses:
readlink /proc/$(pgrep -f server.js)/exe
# /home/ubuntu/node/node-v24.22.0-linux-x64/bin/node <- still the old one!
pkill -f server.js && nohup node server.js > app.log 2>&1 &
readlink /proc/$(pgrep -f server.js)/exe
# /home/ubuntu/node/node-v24.22.1-linux-x64/bin/node <- fixed
The same request still gets a 401, and the body is still unpacked. That’s normal: Brotli support still works. The difference is that it’s now handled by the fixed decoder.
Everything shown here was done on a throwaway test virtual machine (QEMU) built for the video, not on a production server. Read and understand each command, try it on a test system first, and back up before changing a real server.
Summary
- CVE-2026-111497 is a critical bug in the Brotli decoder built into Node.js, and it’s now on CISA’s exploited list.
- Upgrade to 22.23.4, 24.22.1 or 26.12.1. On Node 20? Move to 22 or newer.
- Restart every Node process and rebuild your Docker images.
- Check the version the running process uses, not just the one that’s installed.
Sources: Node.js security release · CVE record · CISA KEV alert, 27 Oct · Brandefense on Node2Shell
More on YouTube
Prefer watching? The full Node2Shell walkthrough is on our YouTube channel: watch the video. For more hands-on breakdowns of security bugs, Linux servers and dev tools, subscribe at youtube.com/@fineshotai.