Node2Shell: Critical Node.js Brotli Flaw Needs Patching Now

If your business runs a website, API, mobile app back end or internal tool built on Node.js, this week’s security release deserves your attention. On 21 October 2026 the Node.js project shipped fixes for ten vulnerabilities, and one of them, a flaw in the bundled Brotli decompression code, has quickly picked up the nickname Node2Shell (some researchers have also started calling it HTTP2Shell). This piece is for developers, IT managers and agency owners who need to know whether they are exposed and what to do before the weekend is out.

Key takeaways

• The flaw is tracked as CVE-2026-111497, an out-of-bounds write in the Brotli decoder that ships inside Node.js.
• Node.js rates it high; the CVE record scores it 9.2 on CVSS 4.0, which is critical.
• Fixed releases are Node.js 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older, and 25.x, are end-of-life and get no fix.
• Apps are exposed when they decompress Brotli data an attacker controls. Express 5 with express.json() does this by default.
• As of late 23 October it was not in CISA’s Known Exploited Vulnerabilities catalogue, but public proof-of-concept code exists.

What happened

Brotli is a compression format widely used on the web to shrink data sent between servers and browsers. Node.js bundles Google’s Brotli decoder so that applications can unpack Brotli-compressed data. Researchers found that a specially crafted Brotli stream can make the decoder write outside the memory it is supposed to use. Depending on the circumstances, that can corrupt memory, leak data, crash the process or, in the worst case, let an attacker run code with the same permissions as the Node.js application. No login is needed to send such a stream.

The Node.js team published patched versions on 21 October. Google’s Brotli library itself was fixed the same day in versions 1.0.10, 1.1.1 and 1.2.1, and related fixes followed for the Python brotli and brotlicffi packages and for the Bun runtime, which was patched in version 1.4.4 on 22 October. The CVE record was published on 22 October.

The other fixes in the same release

Node2Shell is not the only issue fixed. The release also addresses three other high-severity bugs: two (CVE-2026-105483 and CVE-2026-106069) allow TLS certificate hostname checks to be bypassed using unusual IP address formats, and one (CVE-2026-105482) involves dns.resolve truncating names that contain a hidden NUL character. Six further medium and low issues were fixed, and the bundled certificate store now drops trust tied to the compromised eMudhra intermediate certificate authority that browsers blocked earlier this month.

Who is affected

Node.js does not decompress Brotli on its own. The risk depends on what your code and its libraries do. According to published analysis of the flaw, the main exposure points are:

• Express 5 apps using express.json(), because the body-parser 2.x library it relies on decodes Brotli-compressed request bodies by default.
• Server-side fetch() calls to servers you do not control, if a response comes back Brotli-encoded.
• Self-hosted Next.js image optimisation, which Vercel says does not block Brotli responses.
• Any custom code calling createBrotliDecompress or similar functions on untrusted input.

Express 4 apps using body-parser 1.x are less exposed for request bodies, because that version rejects Brotli bodies with a 415 error, though other code paths may still decompress Brotli. Do not forget containers, CI runners, serverless functions and desktop tools that ship their own copy of Node.js.

Is it being exploited?

The picture is still developing. As of the evening of 23 October (UTC), the flaw was not in CISA’s Known Exploited Vulnerabilities catalogue, and the CVE record’s CISA data listed exploitation as “none”. However, one research team said it reproduced remote code execution without authentication, others reported running code on an official Node.js 24.22.0 image in some attempts, and proof-of-concept code is circulating on GitHub. Some analysts argue the realistic impact is denial of service rather than full takeover. Either way, a crash-on-demand bug in a public API is a business problem, so treat this as urgent.

How to check your exposure

1. Check the real runtime version. Run node –version inside the actual server or container, not just on your laptop. Compare it against 22.23.4, 24.22.1 or 26.12.1. A floating image tag such as node:24 does not tell you which patch you are running.
2. Check your Express line. Run npm ls express body-parser to see whether you are on Express 5 with body-parser 2.x.
3. Search your code for express.json, bodyParser, createBrotliDecompress, brotli and outbound fetch calls.
4. List end-of-life runtimes. Anything on Node.js 20 or 25 will not receive this fix and needs a planned upgrade.

Avoid firing public exploit code at production servers to “test” them. No safe official test has been published, and you could take your own service down.

Context for Nigerian and African teams

Node.js powers a large share of fintech back ends, e-commerce stores, logistics dashboards and agency-built client sites across the continent. Many of these run on long-lived VPS instances or container images that were built once and rarely rebuilt. That is exactly where an old Node.js version hides. If a contractor or agency built your platform, ask them directly which Node.js version is in production and when the image was last rebuilt.

What you should do

• Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, then rebuild and redeploy container images on patched base images.
• Move off Node.js 20 and 25 to a supported line (22.x or 24.x) as soon as you can test it.
• Use a stop-gap if you cannot patch today: for Express, set express.json({ inflate: false }), which also rejects gzip bodies, so test your clients first. You can also refuse requests carrying a Content-Encoding: br header at your proxy or load balancer, though that does not protect outbound fetches.
• Reduce the blast radius: run Node.js as an unprivileged user and keep secrets such as API keys out of the process environment where possible.
• Update related packages: Python brotli to 1.2.1, brotlicffi to 1.2.1.0 and Bun to 1.4.4 or later, plus your operating system’s brotli package.
• Do not rely on a web application firewall alone. Patching is the real fix.

Sources

• Brandefense: Node2Shell fixed Node.js versions and check
• SecurityOnline: Node.js October 2026 security release
• CVE Brief: October 23, 2026

Featured image: Photo: “Mediq Utrecht Data center Gwan Kho” by Gwan Kho, CC BY-SA 2.0, via Openverse — source