Security firm 티오리 issues emergency guide for Node2Shell Node.js flaw
티오리 says the Node2Shell vulnerability in Node.js Brotli decompression allows unauthenticated remote code execution; patched versions are available.
South Korean security company 티오리 has released an emergency response guide for enterprises after completing its own verification of the Node.js vulnerability known as Node2Shell (CVE-2026-111497), the company announced on October 26, 2026.
According to 티오리, Node2Shell stems from an out-of-bounds write flaw in Node.js's Brotli decompression module. An attacker can send crafted Brotli data without authentication to crash a server, expose memory, or execute remote code. The Node.js project rates the vulnerability as "high" severity.
Affected versions are the Node.js 22.x, 24.x, and 26.x lines that have not received the latest security patches. The Node.js security team has released fixes in versions 22.23.4, 24.22.1, and 26.12.1 and recommends updating immediately.
티오리 also proposed temporary mitigations at the reverse proxy layer, such as Nginx, or at the application level. The company operates nodejsguard.io, a free online diagnostic service that checks exposure risk by entering only a service address.
Detailed analysis and verification guidance are available on the official Xint technical blog.
Quick answers
Which Node.js versions are affected by Node2Shell?
Node.js 22.x, 24.x, and 26.x lines without the latest security patches.
What versions fix CVE-2026-111497?
Node.js 22.23.4, 24.22.1, and 26.12.1 or later.
Where can I check if my service is exposed?
티오리 operates the free online diagnostic service nodejsguard.io, which requires only a service address.