Node2Shell in Node.js Is Under Attack: A Free Update Closes Your App's Server to Attackers

If your company's app, website, online store or API was built with Node.js, including Next.js sites and Express or NestJS backends, ask your developer today to update Node.js to version 22.23.4, 24.22.1 or 26.12.1, then rebuild and restart the server. The Node.js project released these versions on October 21, 2026 to close a flaw known as Node2Shell (CVE-2026-111497), rated 9.2 out of 10, that lets an attacker with no password run code on your server by sending specially crafted compressed data. Saudi Arabia's National Cybersecurity Authority has issued an alert rated «very high», and on October 27 the US cybersecurity agency CISA confirmed the flaw is being exploited in real attacks.

What exactly happened?

The flaw sits in Brotli, a compression format that web servers and browsers use to shrink the data they exchange, and Node.js ships its own copy of Google's Brotli decoder. According to the Node.js security advisory, malformed compressed input makes the decoder write past the end of an internal buffer, which can crash the application, leak the contents of its memory, or let an attacker run code. The advisory credits OpenAI's Codex Security team with reporting the flaw, and the same release fixed 10 vulnerabilities in total, 4 of them rated high.

Events then moved fast. On October 22, a day after the fix, Imperva's Red Team ran code on the official Node.js 24.22.0 image through two everyday paths: the built-in fetch() function and request bodies handled by Express 5. On October 26, ELLIO recorded real exploit traffic carrying public attack code. On October 27, CISA added the flaw to its catalogue of vulnerabilities exploited in the wild.

The bug itself is old. According to the CVE record, it affects Brotli versions 1.0.3 through 1.2.0, and OpenAI says the root cause had been fixed in Brotli's source code in February 2026 without anyone knowing it was a security flaw and without a new release, until Brotli 1.2.1 shipped on October 21. If this sounds familiar, it is: last week we covered PHP2Shell, the flaw that opened PHP and WordPress servers. Node2Shell is the same kind of risk for apps built on JavaScript.

Is my app affected?

Node.js runs the server side of a large share of modern websites, mobile app backends, dashboards and APIs. If your system was built in the last few years by an agency or a freelance developer, there is a good chance it runs on Node.js without you knowing. The affected lines are 22.x, 24.x and 26.x before the patched versions, plus the end-of-life lines 20.x, 23.x and 25.x, which the Node.js project says are always affected and will get no fix.

Running Node.js alone does not mean you are exposed: something has to hand attacker data to the decoder. Researchers name three common paths:

• Compressed requests coming in. The body parsers in Express 5, body-parser 2 and Koa unpack Brotli-compressed request bodies automatically, before your own code even runs.
• Content your server fetches. If your app opens outside links, such as link previews, webhooks, crawlers or AI agent tools that read web pages, a hostile site can reply with poisoned compressed data. Node's built-in fetch(), axios and server-side fetches in frameworks such as Next.js decode it automatically.
• Files users upload. Any code that decompresses Brotli data supplied by a customer or a visitor.

The risk goes beyond Node.js. The NCA alert names Python, Bun and Envoy as well, and Microsoft released fixes on October 25 for .NET 8, 9, 10 and 11, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4 to 7.6, rating the flaw critical for .NET with the assessment «Exploitation More Likely». Microsoft notes that Brotli decompression is not switched on by default in .NET, so only apps that enabled it are exposed.

If your site is hosted on Vercel, the company says in its advisory that it deployed firewall rules blocking the incoming attack path for every project on the same day Node.js published the fix, and that all new deployments have used a patched Node.js since October 28. Existing projects need a redeploy, and projects still on Node.js 20 must switch to 22 or 24.

What to do today: five steps

1. Ask one written question. Which Node.js version runs on our servers and inside our Docker images? Ask your developer to check the Node.js release number with the command node -v. Do not rely on the Brotli version string: ELLIO found it shows 1.2.0 on patched and unpatched builds alike.
2. Update to a patched version. 22.23.4, 24.22.1 or 26.12.1. If you are on 20.x, 23.x or 25.x, move to a supported line such as 22 or 24, and test before going live.
3. Rebuild and restart. A running process keeps the old code. Rebuild container images on a patched base image, because a Dockerfile pinned to 24.22.0 keeps shipping the vulnerable build until someone edits that line. Check staging servers, build pipelines and serverless functions too.
4. Update the other copies. Python's Brotli and brotlicffi packages (versions 1.2.1 and 1.2.1.0), Bun, Envoy, the Brotli library of your Linux distribution, and .NET through Microsoft's October 25 update.
5. Check logs and crash files. Look for unusually large Brotli-compressed requests and repeated worker crashes. ELLIO warns that most failed attacks crash the worker, and that a crash file can hold visitors' session cookies and keys, so limit who can read crash files (core dumps) and how long you keep them.

If you cannot update today

As a temporary measure, block incoming requests that carry the Content-Encoding: br header at your front-end server or firewall, if your app does not need them. Vercel and Imperva have added firewall rules for this flaw, but Vercel itself stresses that a firewall does not cover responses your server fetches from other sites: only the Node.js update closes that path. Treat any protection layer as extra time, not as a replacement for the update.

The Origami view

Two critical flaws in the foundations of the web in one month, PHP2Shell and then Node2Shell, tell a clear story: the code your team wrote may be fine while the runtime underneath it is open. The fix for Node2Shell sat in Brotli's source code for about eight months before anyone understood it was a security problem, and once the details went public, researchers needed one day to run code on an official build. What we see at many companies is an app delivered years ago with nobody owning its updates, and no list of where Node.js actually runs. If that is your situation, start that list today. At Origami we build web apps and systems, many of them on Node.js and Next.js, and we keep their runtime updates under watch from day one. If you want your app checked, or Node.js upgraded without downtime, contact us.

Sources

• Saudi National Cybersecurity Authority (NCA): Brotli alert no. 2026-7959
• Node.js: October 21, 2026 security releases
• Google Brotli on GitHub: version 1.2.1 release notes
• CVE.org: record for CVE-2026-111497, affected versions and 9.2 score
• CISA: two exploited vulnerabilities added to the catalogue, October 27, 2026
• Microsoft Security Response Center: CVE-2026-111497
• Vercel: Node.js security advisory
• Imperva Red Team: Node2Shell, from Brotli data to code execution
• ELLIO: Node2Shell exploitation in the wild
• SecurityWeek: patches across Microsoft, Node.js and Python packages