Node2Shell: CISA Warns Attackers Are Exploiting a Critical Node.js Flaw
A critical flaw nicknamed Node2Shell is now under active attack. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on October 27, according to Help Net Security. The flaw is tracked as CVE-2026-111497, and it is in Google’s widely used Brotli compression library.
If you run Node.js servers, update now. If you use other software that bundles Brotli, you need to check that too.
What the Flaw Does
CVE-2026-111497 is a remotely exploitable out-of-bounds write in the Brotli decoder. Node.js maintainers explain that an attacker who can supply Brotli data that an application decompresses can corrupt process memory. That can lead to a crash, disclosure of process memory, or remote code execution.
Node.js disclosed the flaw on October 21 when it shipped security releases. Brandefense notes that the CVE record scores the bug 9.2 on the CVSS 4.0 scale, while Node.js rates it high.
Who Is Affected
The fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1. End-of-life lines 20.x, 23.x and 25.x are also affected, but they will not get a fix, according to Help Net Security.
The problem reaches well beyond Node.js. Tenable researchers say any application that decompresses attacker-controlled data with a vulnerable Brotli decoder is potentially at risk. Their list includes .NET, Bun, Envoy Proxy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse. Most of those projects have already shipped updates, and Linux distributions are following.
Exposure depends on how your software is used. Rapid7 notes that having an affected decoder does not by itself mean you are exposed. The risk arises when an application processes Brotli data from an untrusted source. Akamai adds that common paths such as fetch() and Express 5 can expose applications that never call the Brotli API directly.
The Attacks Have Started
Public proof-of-concept exploits are on GitHub. Imperva has demonstrated remote code execution against the official Node.js 24.22.0 Linux arm64 image after multiple attempts.
Threat intelligence firm ELLIO reported on Monday that its sensors recorded exploit traffic in the wild. It says the attacking IP address has previously carried exploits for PHP2Shell and been involved in probing of Palo Alto GlobalProtect, FortiOS SSL VPN and Kubernetes interfaces. ELLIO describes this as a sign of an operator focused on mass exploitation.
The same week, The Hacker News reported that attackers are exploiting the PHP2Shell flaws in internet-exposed Palo Alto Networks management interfaces. The two campaigns show how quickly criminals move on fresh bugs.
Why the Fix Was So Late
Help Net Security reports that the fix was committed to the Brotli repository on February 27, 2026, with no release and no advisory. It stayed publicly readable for eight months. Fixed Brotli versions 1.2.1, 1.1.1 and 1.0.10 were released only on October 21.
That gap matters. A public code fix with no advisory can give attackers a roadmap while defenders have no warning.
What to Do Now
Akamai says the Node.js advisory offers no workaround, so upgrading is the only complete fix. Teams on a discontinued release line should move to a supported one.
A check is trickier than it looks. Cyber Security News reports that Node.js applied the fix without changing the bundled Brotli version string, so process.versions.brotli reports 1.2.0 on both patched and unpatched builds. Check your Node.js release number instead.
Aikido Security advises updating dependency lock files, rebuilding applications and container images, redeploying, restarting services, and verifying that running workloads use the patched components. Microsoft also released out-of-band .NET updates for the flaw, according to Cycode’s tracking.
This final point is our own advice: if you cannot patch immediately, list the services that decompress Brotli data from outside your network and patch those first.
The Bigger Picture
Node2Shell follows closely on PHP2Shell, which hit PHP earlier this month. Both are critical flaws in software that powers huge parts of the web. For wider context, read our roundup of the worst cyberattacks and data breaches of 2026 and our guide to protecting yourself from AI-powered cyber threats. Patch problems can go wrong too, as our report on Microsoft’s broken September Patch Tuesday shows, so test before you roll out.
