In short: First PHP, now Node.js. On 21 October 2026 the Node.js project released updates for ten security flaws. The most serious one, CVE-2026-111497, sits in the Brotli decoder that ships with Node.js. Crafted data can corrupt server memory and in the worst case lead to remote code execution. Node.js 22, 24 and 26 are affected. As of 25 October 2026: anyone running Node.js updates to v22.23.4, v24.22.1 or v26.12.1.

What happened

Node.js is the environment that runs JavaScript on servers. Many online shops, customer portals, CRM systems, interfaces (APIs), chat bots and internal tools are built on it, often without the business side knowing.

Brotli is a method web servers and browsers use to compress data so it travels faster. Node.js ships its own decoder for it in the node:zlib module. According to Node.js, this decoder reported a certain format error as “need more input” instead of an error. It therefore kept appending bytes to an internal buffer of only eight bytes and wrote past its end. Experts call this an out-of-bounds write: data lands in memory not meant for it.

The consequences according to Node.js: a crash of the service, disclosure of process memory or remote code execution. Node.js rates the flaw “high”. It was found by researchers at OpenAI Codex Security.

Why “Node2Shell”

On social media the flaw circulates as “Node2Shell”, a nod to PHP2Shell from the same week. “Shell” stands for a server's command line, meaning full control. Node.js itself refers to the flaw only by its CVE number. A CVE number is the worldwide unique identifier of a vulnerability.

Who is affected

The Node.js 22, 24 and 26 release lines are affected. Older lines such as Node.js 20 or 18 no longer receive updates. Node.js states that end-of-life versions are always considered affected when a security release occurs.

It becomes dangerous wherever Brotli data from outside reaches the decoder. Two examples:

  • Incoming requests: The widely used body-parser package reads request data in Express applications. In version 2, which comes with Express 5, it decompresses Brotli data automatically when the sender labels it that way. An attacker needs no login for this.
  • Responses from other servers: If your application fetches data from other services, for example via fetch for webhooks or partner interfaces, Node.js decompresses those responses too. A manipulated or compromised counterpart can send malicious data this way.

The Node.js security release names no known attacks (as of 25 October 2026). Experience shows that attackers quickly scan for unpatched systems after a disclosure.

What else the update fixes

The update of 21 October 2026 fixes nine further flaws. Node.js also rates three of them “high”: name resolution via dns.resolve could truncate names containing an invisible control character (CVE-2026-105482). Two errors in TLS certificate checks allowed a certificate to be accepted for the wrong IP address (CVE-2026-105483, CVE-2026-106069). TLS is the encryption behind https, for example. In addition, components such as OpenSSL, c-ares, Undici and SQLite were updated and a compromised eMudhra intermediate certificate was removed.

What to do now

  1. List all Node.js applications. This includes applications an agency or service provider runs for you: shop, customer portal, interfaces, chat bots, internal tools. Ask for the output of node -v on every server, in every container and in the build environment (CI) where software is built.
  2. Install the update or have it confirmed. Safe versions are Node.js v22.23.4, v24.22.1 and v26.12.1. Docker images must be rebuilt, a restart is not enough. If you get Node.js from your Linux distribution's packages (such as Debian or Ubuntu), have it confirmed that the fix for CVE-2026-111497 is included. Applications on Node.js 20 or older need a move to a supported line. That is more than a small update and should be planned now.
  3. Bridge the gap if it does not work today. Node.js names no official workaround. The attack surface can still be reduced: the web server or proxy in front can reject requests with compressed content (header Content-Encoding), and body-parser stops accepting compressed data with the setting inflate: false. This does not replace the update.
  4. Check for traces. An update closes the flaw but does not tell you whether someone got in before. Look for unexplained crashes of Node.js processes in the logs, for Node.js processes that start a command line or programs like curl and wget, and for new, unknown files in the application folder.
  5. Rotate credentials if anything looks wrong. Node.js applications often keep keys for the database, payment provider or cloud in memory. Because the flaw allows memory disclosure, these keys count as known on a suspicious server. Organisations covered by NIS 2 send an initial report to the BSI within 24 hours of a significant incident, followed by a detailed report within 72 hours.

What the case shows

PHP2Shell and Node2Shell in one week show the same pattern: the flaw is not in your own application but in the technology underneath. Anyone who does not know which runtime runs where and in which version loses hours searching in such situations. A list of all applications with their technology and owners, a software bill of materials (SBOM, a list of all components of a piece of software) and an agreed update path with service providers solve this.

How GermanAI Defense helps

We offer a Node.js quick check: together with you we list the applications running on Node.js, check versions on servers, in containers and in the build environment, and on request look for traces of an intrusion. You receive a short list with findings and next steps.

→ More about our Cybersecurity Services: View Cybersecurity Services

Sources: nodejs.org, Wednesday, October 21, 2026 Security Releases · nodejs.org, release schedule · body-parser, documentation