Node2Shell check: is your Node.js affected by CVE-2026-111497?

Node2Shell is a flaw in the Brotli decoder bundled with Node.js. It can lead to remote code execution, and your app can be exposed even if you never call Brotli yourself. Here is how to check and how to fix it.

This one has to be checked on your server. Your Node.js version can't be read safely from outside, so no outside scan can confirm this flaw for you. If your site shows signs of Node.js, Threat Watch flags it as a prompt to check. Image scanners may miss it too: in our test, Trivy didn't flag this CVE in an official Node.js image. Run the checks below yourself.

What is Node2Shell?

Node2Shell is the name for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. Malformed compressed data can write past the end of an internal buffer. Node.js says this can lead to a crash, disclosure of process memory, or remote code execution.

Node.js rates it high, and Google, which assigned the CVE, rates it critical with a CVSS v4 score of 9.2. CISA added it to its Known Exploited Vulnerabilities catalog on 27 October 2026.

Is your app exposed?

Exposure depends on whether your app decompresses Brotli data that an attacker can control. Akamai lists three main paths:

Your code passes untrusted data to zlib.brotliDecompress() or zlib.createBrotliDecompress().
Your app uses the built-in fetch(), which decompresses Brotli responses automatically, so a malicious or compromised server can target it.
Your server uses Express 5 or body-parser 2. Their json, raw, text and urlencoded parsers decompress Brotli request bodies by default, and any client can send one.

Akamai notes that a bare Node.js HTTP server doesn't decode incoming Brotli bodies by itself. You should still upgrade, because a dependency may do this for you.

How to check your Node.js version

Node.js often runs in more places than you expect, so check each one.

# On the server
node -v

# Every running Node.js process
ps aux | grep -i '[n]ode'

# Versions installed through nvm
ls ~/.nvm/versions/node

# Inside a running container, then inside an image
docker exec <container> node -v
docker run --rm --entrypoint node <image> -v

# Does this project use Express or body-parser?
npm ls express body-parser

You're on a fixed release if you're running Node.js 22.23.4, 24.22.1, 26.12.1 or later on that line. Also check version managers, application folders, single-executable apps, bundled runtimes and serverless functions.

How to fix Node2Shell

Upgrade to Node.js 22.23.4, 24.22.1, 26.12.1 or later, then restart your apps. If you use containers, rebuild your images and redeploy them, because a pinned image tag won't update by itself.

Node.js 25, 23, 20 and older are out of support and don't receive this fix, so move to a supported release line. If your distribution packages Node.js, install your vendor's nodejs and brotli updates.

If you can't upgrade straight away

Node.js doesn't offer a workaround, so upgrading is the only complete fix. These steps from Akamai reduce risk in the meantime:

On Express or body-parser, set the inflate option to false. Compressed request bodies are then rejected with HTTP 415. This doesn't protect fetch() or other code paths.
Restrict inbound access to Node.js services, and limit their outbound connections.

Other software with the same flaw

The flaw comes from Google's Brotli decoder, so upgrading Node.js doesn't fix other software that uses it. Rapid7 lists affected downstream products including Bun, Python's Brotli and brotlicffi packages, .NET, Envoy, Istio, brotli4j and some operating system packages. Check your vendors' advisories.

Test your site with Threat Watch

Threat Watch flags sites that show signs of Node.js as a prompt to run the checks above. It also runs 490+ known-exploited vulnerability checks, including 280+ for remote code execution, and it's free on every plan.

PHP2Shell scanner: check your site and fix it

Sources

Create a free account · PHP2Shell scanner · Node2Shell check