Node.js patches high-severity Node2Shell RCE flaw
Security updates released October 21 fix CVE-2026-111497 in Node.js Brotli decompression; patched versions are 22.23.4, 24.22.1 and 26.12.1.
The Node.js team released security updates on October 21 for a high-severity remote code execution vulnerability named Node2Shell, tracked as CVE-2026-111497, according to dailysecu.com. The team rated the flaw High.
The vulnerability lies in Node.js's Brotli decompression functionality and can cause out-of-bounds memory writes. Imperva researchers demonstrated remote code execution in a real environment.
Express 5 web services can be affected automatically even if developers do not use Brotli directly, and Node.js's built-in fetch() as well as libraries such as axios may be exposed when handling compressed responses from external servers.
The patched versions are 22.23.4, 24.22.1 and 26.12.1. Node.js processes must be restarted after updating, and container images must be redeployed.
The vulnerability was discovered and reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security. The disclosure follows the recent critical PHP2Shell vulnerability in PHP.
Quick answers
Which Node.js versions fix Node2Shell?
The patched versions are 22.23.4, 24.22.1 and 26.12.1.
Do I need to restart after updating Node.js?
Yes. Node.js processes must be restarted after updating, and container images must be redeployed.
What is the CVE ID for Node2Shell?
The vulnerability is tracked as CVE-2026-111497 and was rated High.