Enki WhiteHat releases safe checker for Node.js Node2Shell flaw
The diagnostic script probes running Node processes and patch constants instead of sending exploit traffic, according to dailysecu.com.
Security company Enki WhiteHat released an internal diagnostic script on October 27, 2026 that lets administrators check servers for the Node.js vulnerability known as Node2Shell (CVE-2026-111497), according to dailysecu.com.
Node2Shell stems from the Brotli decoder in affected Node.js versions writing outside internal buffer bounds when it handles crafted compressed data. The flaw can crash processes, expose memory and allow remote code execution that could lead to a server being taken over.
The vulnerable releases are Node.js 22.x, 24.x and 26.x without security patches, along with end-of-life versions 20.x and below, and 21.x, 23.x and 25.x.
How the check works
Rather than sending attack inputs to the target, the script looks for internal evidence: it reads running Node processes and patch-related constants. Results are reported in three states — patched, suspected vulnerable, or input path needs checking.
The script can be downloaded for each operating system from a dedicated diagnostic page at
Quick answers
What is Node2Shell (CVE-2026-111497)?
It is a Node.js vulnerability caused by the Brotli decoder writing outside internal buffer bounds when handling crafted compressed data, which can lead to crashes, memory disclosure and remote code execution.
Which Node.js versions are affected?
Node.js 22.x, 24.x and 26.x without security patches, plus end-of-life versions 20.x and below, and 21.x, 23.x and 25.x.
Where can I download the diagnostic script?
From the dedicated diagnostic page at with a build for each operating system.