# Node2Shell: Patch Node.js Now for Brotli Flaw CVE-2026-111497

- URL: https://usa-24.com/node2shell-nodejs-brotli-patch/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-10-25T01:13:36.367Z
- Updated: 2026-10-25T01:13:36.374Z
- Topics: Node.js, Brotli, Remote Code Execution, AI Security, Black October

> Public exploit code for a new Node.js remote-code-execution flaw appeared a day after the October 21 patch. Here is who is most exposed and which releases fix it.

## Key takeaways

- Node.js fixed CVE-2026-111497 on October 21, 2026, in versions 22.23.4, 24.22.1 and 26.12.1.
- Public proof-of-concept code appeared on October 22, one day after the patch shipped.
- Updating the separate npm package named brotli does not fix the flaw; only a fixed Node.js runtime does.
- Node.js 20.x reached end of life on April 30, 2026, and gets no fix for this bug.
- Express 5 and body-parser 2.x decode Brotli request bodies by default, which widens exposure for many web apps.

Public exploit code for a new Node.js remote-code-execution flaw appeared on October 22, one day after the project shipped its fix. The bug, CVE-2026-111497, has been nicknamed Node2Shell, and it sits in the Brotli decompression code that Node.js bundles with its runtime. US developers running Node.js servers in production now have a short window to check their versions, because the proof of concept is already public.

## What Node2Shell is and how it differs from PHP2Shell

Node.js fixed CVE-2026-111497 on October 21, 2026, in its October security release. The flaw is an out-of-bounds write in the Brotli decoder, the compression library Node.js uses to decompress data. According to the Node.js advisory as relayed by researchers, the bug was found and reported by Khai Tran and Sylvie Mayer of OpenAI's Codex Security team. I could not reach the Node.js advisory directly, so the technical details here come from security vendors and researchers.

Node2Shell is not the same bug as PHP2Shell. USA 24 has covered PHP2Shell, which affects a different runtime, in [its earlier report on the PHP flaws](https://usa-24.com/php2shell-patch-ai-found-flaws/). Teams that patched PHP should not assume they are covered for Node.js, and the reverse is also true.

## Where the Brotli bug came from

Brotli is not Node.js code. Google maintains the upstream library, and according to [Cycode's timeline](https://cycode.com/blog/node2shell-cve-2026-111497/), a fix was committed to the google/brotli repository on February 27, 2026. No release or advisory followed at that time. The upstream fixes arrived in Brotli 1.0.10, 1.1.1 and 1.2.1.

The affected ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1, according to [Rescana](https://www.rescana.com/post/nodejs-cve-2026-111497-node2shell-brotli-rce-october-2026). That means a fix sat in public source code for months before Node.js shipped a runtime with the patch. Cycode also reports that Bun 1.4.4 shipped with the fixed Brotli library.

Imperva's Red Team tested the official Node.js 24.22.0 Linux arm64 image and ran code execution against it. The same input was rejected by 24.22.1, according to [Imperva's write-up](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/). Imperva also says it has added web application firewall rules for the flaw.

## Which Node.js versions get the fix

| Release line | Fixed version | Status |
|---|---|---|
| Node.js 22.x | 22.23.4 | Fixed October 21, 2026 |
| Node.js 24.x | 24.22.1 | Fixed October 21, 2026 |
| Node.js 26.x | 26.12.1 | Fixed October 21, 2026 |
| Node.js 20.x | None | End of life April 30, 2026 |

Node.js 20.x reached end of life on April 30, 2026, and it gets no fix for this flaw. Teams on that line have no vendor patch to apply. They need to migrate to a supported release, and other end-of-life lines are in the same position.

Updating the unrelated npm package named "brotli" does not remove the flaw, according to [HeroDevs](https://www.herodevs.com/blog-posts/cve-2026-111497-node2shell-node-js-brotli-rce). Only a fixed Node.js runtime build does. That distinction matters because many teams manage dependencies in package.json and assume a package bump covers them.

## How severe the flaw is and what remains unknown

Node.js rates the flaw High and says it permits remote code execution. Sources disagree on whether Node.js published its own CVSS score. The CVE record scores it 9.2 under CVSS 4.0, according to [Brandefense](https://brandefense.io/blog/node2shell-nodejs-brotli-rce-cve-2026-111497/).

As of October 23, the flaw was not in CISA's Known Exploited Vulnerabilities catalog, according to [Indusface](https://www.indusface.com/blog/cve-2026-111497-node2shell-nodejs-brotli-rce/). Public proof-of-concept code has circulated since October 22. Whether CISA adds the flaw to that catalog, and whether anyone has confirmed attacks in the wild, is still unknown.

## Is my Node.js app vulnerable to Node2Shell

Express 5 and body-parser 2.x decode Brotli request bodies by default, which makes many web apps reachable by this path. Imperva tested against Express 5.3.0 and body-parser 2.3.0, the latest releases when it ran its tests on October 22. Express 5 and Koa apps that decompress Brotli request bodies face the most direct exposure, according to Indusface and Cycode.

The risk is highest for production services on Node.js 22, 24 or 26 that accept compressed requests and sit below the fixed releases. Containers add a wrinkle. The Node.js version inside an image can differ from the version on the host, so a server that looks patched may still be running an old runtime.

## What to do this weekend

- Upgrade the Node.js runtime itself to 22.23.4, 24.22.1 or 26.12.1. Upgrading npm packages alone does not help.
- Check the runtime version inside every container image, including base images used in CI pipelines. Running `node -v` inside the container gives the answer.
- Move any Node.js 20 service to a supported release line, since no fix is coming for that line.
- If you cannot patch right away, disable body-parser inflation, reject requests with Content-Encoding "br" at the edge, or add WAF rules. Imperva and Brandefense both say these measures are a layer of defense, not a substitute for upgrading.

## Why the gap between patch and exploit is the real risk

The fix became public on October 21, and proof-of-concept code followed on October 22. That one-day gap leaves little time for teams to inventory services, test upgrades and roll out changes. Researchers quoted in the coverage argue the window between patch and exploit is the core risk, because the bug had been fixed upstream months before the public disclosure.

That pattern is familiar from other open-source incidents. A fix lands quietly in a dependency, then a public disclosure and exploit code arrive together. Teams that treat the Node.js runtime as a platform component with its own patch cycle, rather than as a background dependency, will close that gap faster.

## Black October and the AI question

Security leaders have framed the week as "Black October." Jason Clinton, deputy chief information security officer at Anthropic, described the situation as a "vulnerability tsunami," according to [RocketNews](https://rocketnews.com/2026/10/black-october-cybersecurity-experts-sound-the-alarm-over-new-era-of-ai-enabled-hacking/). In [Finwire's version of the same report](https://finwire.io/news/world-news/black-october-cybersecurity-experts-sound-the-alarm-over-new-era-of-ai-enabled-hacking), Clinton is quoted saying, "There won't be enough time to patch critical infrastructure." Salesforce CEO Marc Benioff called the week a "code red," per the same coverage.

The "Black October" label is trending on X and is tied to a string of security scares that week, led by PHP2Shell, according to [Raw Story](https://www.rawstory.com/agentic-ai/). The label is a media shorthand, not an official designation, and the individual incidents need to be judged on their own facts.

OpenAI's Codex Security team helped find this flaw, according to the Node.js advisory as relayed by researchers. That claim rests on secondhand reporting. One blog attributes the PHP discovery to OpenAI's GPT-5.6 Sol, but that remains a single-source claim, and [GPTunneL's roundup](https://www.gptunnel.ru/en/blog/black-october-hacks) does not establish how much AI assistance was involved in either bug.

## What to watch next

Three questions will decide how this story develops. The first is whether Node.js publishes its own advisory text and a score, which would settle the disagreement among sources. The second is whether CISA adds CVE-2026-111497 to its Known Exploited Vulnerabilities catalog. The third is whether the unofficial name "HTTP2Shell," which surfaced late on October 23 UTC, catches on in scanner signatures and threat reports. It still carries the same CVE number, so teams searching for either name should land on the same fix.

If exploitation shows up in the wild, expect WAF rules and scanner signatures to become the first line of defense for teams that cannot upgrade quickly. The lasting lesson is simpler. The clock on this bug started on October 21, and the teams that patch the runtime itself, and check every container image, will be the ones that avoid the next scramble.

## Frequently asked questions

### Is my Node.js app vulnerable to Node2Shell?

You are exposed if you run Node.js 22, 24 or 26 below the fixed releases. Express 5 and body-parser 2.x decode Brotli request bodies by default, which raises the risk for many web apps. Run node -v inside each container and on each host to confirm the version.

### Which Node.js versions fix CVE-2026-111497?

Node.js fixed the flaw on October 21, 2026, in versions 22.23.4, 24.22.1 and 26.12.1. Node.js 20.x reached end of life on April 30, 2026, and gets no fix, so those services must move to a supported release. Updating the separate npm brotli package does not remove the flaw.

### Is Node2Shell the same bug as PHP2Shell?

No. Node2Shell is a remote-code-execution flaw in the Brotli decoder that Node.js bundles, while PHP2Shell affects PHP. Patching one runtime does not protect the other, so teams running both need to check each separately.

### Is CVE-2026-111497 being exploited in the wild?

Confirmed in-the-wild exploitation has not been reported in the sources reviewed. The flaw was not in CISA's Known Exploited Vulnerabilities catalog as of October 23, 2026. Public proof-of-concept code has circulated since October 22, which makes exploitation more likely.

### What is HTTP2Shell?

HTTP2Shell is an unofficial name that researchers began using late on October 23 UTC for the same flaw. It is still tracked under CVE-2026-111497. Teams searching for either name should apply the same Node.js runtime fix.

## Sources

1. [Node2Shell (CVE-2026-111497): Node.js Brotli RCE — Indusface](https://www.indusface.com/blog/cve-2026-111497-node2shell-nodejs-brotli-rce/)
2. [CVE-2026-111497 (Node2Shell): Node.js Brotli RCE Fix — HeroDevs](https://www.herodevs.com/blog-posts/cve-2026-111497-node2shell-node-js-brotli-rce)
3. [node2shell (CVE-2026-111497): What to Patch in Node.js — Cycode](https://cycode.com/blog/node2shell-cve-2026-111497/)
4. [Node2Shell: Node.js Brotli Flaw CVE-2026-111497 Can Allow Remote Code Execution — Rescana](https://www.rescana.com/post/nodejs-cve-2026-111497-node2shell-brotli-rce-october-2026)
5. [Node2Shell: From Brotli Data to Remote Code Execution — Imperva](https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/)
6. [Node2Shell: Node.js Brotli RCE (CVE-2026-111497), Fixed Versions and How to Check — Brandefense](https://brandefense.io/blog/node2shell-nodejs-brotli-rce-cve-2026-111497/)
7. [Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept — Cyber Kendra](https://www.cyberkendra.com/2026/10/nodejs-october-2026-security-releases-cve-2026-111497.html)
8. [Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix — Aikido](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497)
9. ['Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking — RocketNews](https://rocketnews.com/2026/10/black-october-cybersecurity-experts-sound-the-alarm-over-new-era-of-ai-enabled-hacking/)
10. ['Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking — Finwire](https://finwire.io/news/world-news/black-october-cybersecurity-experts-sound-the-alarm-over-new-era-of-ai-enabled-hacking)
11. [Black October: a PHP flaw, hackers with Claude Code and 9 more incidents — GPTunneL](https://www.gptunnel.ru/en/blog/black-october-hacks)
12. [Mass 'Black October' panic as insiders suddenly whisper about possible internet lockdowns — Raw Story](https://www.rawstory.com/agentic-ai/)