Skip to content 
Firms should urgently address Node2Shell (CVE-2026-111497), a high-severity vulnerability affecting Node.js that could allow an attacker who can supply specially crafted, untrusted Brotli data to cause a crash, disclose process memory, or potentially achieve remote code execution.
Security researchers have demonstrated remote code execution, and exploitation attempts have been observed in the wild. With public exploit code available, the risk of further exploitation is elevated, making prompt remediation a priority.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on October 27, 2026, and set a November 10 remediation deadline for U.S. federal civilian agencies. Although that deadline applies specifically to federal agencies, the availability of patches, public proof-of-concept material, and reported exploitation attempts warrant prompt remediation.
Vulnerability Details
Node2Shell affects the Brotli decoder bundled with Node.js and other software to process compressed data. The vulnerability can allow specially crafted data to exploit a flaw in the decoder. Applications may be exposed even if they do not directly call a Brotli API, because frameworks or dependencies may decompress attacker-controlled Brotli data.
The following Node.js release lines are affected:
- Node.js 22.x: Versions before 22.23.4
- Node.js 24.x: Versions before 24.22.1
- Node.js 26.x: Versions before 26.12.1
End-of-life Node.js release lines, including 25.x, 23.x, 20.x, and earlier releases, do not receive a fix and should be migrated to a supported release. Organizations running these versions should migrate to a supported release containing the patch. Other software incorporating the vulnerable Brotli component may also be affected, including .NET and Python Brotli packages. Firms should consult the relevant vendor advisories to determine their exposure.
Recommended Actions
ACA recommends that organizations take the following actions to address this vulnerability:
- Identify affected systems: Review software inventories and dependency records to identify Node.js deployments across production servers, internet-facing applications, containers, cloud workloads, serverless environments, and development pipelines. Include applications that bundle their own runtimes or third-party components that incorporate Brotli.
- Apply security updates immediately: For Node.js installations sourced from the Node.js project, upgrade to 22.23.4, 24.22.1, or 26.12.1 or later. For vendor-packaged or embedded runtimes, apply the relevant vendor security update. Migrate unsupported versions to a supported release containing the fix.
- Verify remediation: Restart or redeploy affected applications and rebuild container images where necessary. Confirm that patched versions are running across all affected environments.
- Implement interim safeguards: Where immediate patching is not possible, restrict access to vulnerable services and prevent the processing of untrusted compressed data where operationally feasible. These measures provide only partial protection and must not replace the security updates.
- Investigate potential exploitation: Review application and network logs for suspicious requests, unexpected process execution, unusual outbound connections, and unexplained service crashes. Investigate suspected compromise and initiate incident response procedures as appropriate.
Given the availability of public exploit code and reports of exploitation attempts, organizations should prioritize remediation and verify that all affected systems have been addressed.
How ACA Can Help
ACA Aponix can help your organization assess exposure to Node2Shell, prioritize remediation across affected applications and environments, and validate that security updates have been deployed effectively.
Our cybersecurity team also supports vulnerability management program assessments, incident-response planning, and post-incident investigation.