What this covers:
CISA added the Node2Shell flaw to its Known Exploited Vulnerabilities catalog on October 27, 2026 and told federal civilian agencies to patch by November 10. The flaw, tracked as CVE-2026-111497, is a memory corruption bug in Google’s Brotli decompression code that can end in remote code execution.
CISA gave no detail about the attacks behind the listing. Two security firms say their sensors caught attempts anyway, and one of those attempts used an exploit that did not work.
Here is what the Node2Shell flaw breaks, who actually runs the affected code, and the five steps that close it.
What the Node2Shell Flaw Actually Breaks
Brotli is the compression format your browser and most web servers already use. Node.js bundles its own Brotli decoder, and that decoder mishandled one malformed case.
The Node.js advisory describes it precisely. A compressed stream asked for a block switch that its own structure made invalid.
The decoder should have treated that as a permanent format error. Instead it reported a temporary need for more input and kept appending bytes to an eight-byte internal buffer.
Writing past that buffer is the whole bug. Depending on what sits next to it in memory, the result is a crash, the disclosure of process memory, or code execution. An attacker needs no login and no credentials, just the ability to hand the application Brotli data it will decompress.
CISA’s own wording calls it an unchecked return value vulnerability that lets a remote unauthenticated attacker “corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code.”
Google’s CVSS v4 score is 9.2, critical. Node.js rated its own advisory high severity. The flaw also goes by Broccoli2Shell, HTTP2Shell and Brotli2Shell, which is why the same bug shows up under four names in vendor alerts.
Who Is Exposed to the Node2Shell Flaw
The bug is in Node.js, but the exposure is wider than Node.js servers, and that is the part most businesses get wrong.
Fixed Node.js releases: 22.23.4, 24.22.1 and 26.12.1, published October 21, 2026. The discontinued 20.x, 23.x and 25.x lines will not receive a fix at all.
Other affected software: Google’s Brotli library from 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1), the .NET runtime, Bun, Envoy, Istio, some Python HTTP clients, PHP on Windows, and Palo Alto Networks PAN-OS, where hotfixes are rolling out.
Three paths reach the decoder, according to Imperva’s analysis:
1. Direct decompression. Applications that pass untrusted input to the zlib Brotli functions.
2. Inbound request bodies. Express 5 and body-parser 2 decompress Brotli request bodies by default, so any client can send one.
3. Outbound responses. Node’s built-in fetch function decompresses Brotli responses automatically. A compromised or malicious server can attack the client.
That third path is the reason a business can be exposed without hosting anything public. A scheduled job, a container, or a developer laptop that calls an outside API with fetch is enough.
How to Fix the Node2Shell Flaw This Week
Five steps, in order. The first one is the only complete fix.
1. Get off the affected runtime. Move to Node.js 22.23.4, 24.22.1, 26.12.1 or newer. There is no configuration workaround in the Node.js advisory.
2. Rebuild and redeploy container images. A package inventory will miss an older Node binary baked into an image, which is where most stale runtimes hide. Check the version inside each deployed image, not in the manifest.
3. Restart the affected processes. Updating files on disk does nothing for a process still running the old decoder in memory.
4. Turn off compressed request bodies you do not need. Setting body-parser’s inflate option to false makes the parser reject them with an HTTP 415, which removes that path to the decoder entirely.
5. Buy time at the edge while you patch. Block incoming Brotli-compressed requests at the proxy or firewall, or disable Brotli decoding, and lean on web application firewall rules.
Imperva has published rules for CVE-2026-111497 and published its own proof of concept, so defenders should assume exploit code is available.
Steps one to three are the same discipline as any emergency patch, and the reason what a messy patch weekend actually looks like keeps coming up on this blog. If you want the shorter version, our zero-day patching walkthrough covers the same order of operations for phones and laptops.
What the First Node2Shell Flaw Attacks Tell Us
The telemetry on the Node2Shell flaw so far is small, and it is worth reading carefully rather than panicking over.
Previdian, which runs its own sensor network, reported one exploitation attempt on October 27 from a US-based address and rated its confidence as confirmed.
The firm spelled out what that word means: confidence describes how strongly the evidence supports treating the traffic as exploitation of this vulnerability, and does not mean the attempt succeeded.
ELLIO, a lab that tracks mass exploitation, caught a request on October 26 aimed at Node.js 24.22.0 on x86-64.
The address behind it had previously been seen probing PHP2Shell, Palo Alto GlobalProtect and FortiOS VPN devices, which is the signature of an operator hunting volume rather than a targeted campaign.
The same lab also found the attacker’s exploit was broken. Its delivery code matched public proof of concept, but the final stage produced no shell in 50 lab attempts. ELLIO’s read is that it was a first-generation attempt fired before the author tested against a live target.
That is temporary. Imperva’s red team did get code execution against the official Node.js 24.22.0 image with no debugger and no instrumented binary, including through Express 5 request bodies. The fixed 24.22.1 rejected the same input.
One practical warning comes out of that work: failed exploitation attempts can still crash the process, so the Node2Shell flaw is usable for denial of service even when the shell does not land.
Node2Shell Flaw FAQ
Is the Node2Shell flaw being used to install ransomware? CISA lists ransomware use as unknown, which means nobody has confirmed it yet. Treat that as “not observed”, not as “ruled out”.
Do we have to patch if we are not a federal agency? CISA’s directive only binds federal civilian agencies, but the agency urged all network defenders to prioritize this one. The bug is in code that ships inside ordinary business applications.
Does this affect our website if we do not run Node.js? Check what your site, its build tools and its integrations actually run on. Node.js appears in hosting layers, in third-party services and in the fetch calls applications make to outside APIs.
Is upgrading enough to close the Node2Shell flaw, or do we need more? Upgrading is the complete fix. Segmentation limits blast radius afterward, and a WAF rule is a bridge, not a permanent answer.
What is the single first thing to do? Get an accurate list of every Node.js runtime you own, including the ones inside containers. Patch deadlines are easy; inventories are the part that usually fails.
Sources: Node.js security releases, October 21 2026; CISA Known Exploited Vulnerabilities catalog; BleepingComputer; SecurityWeek; Imperva; FortiGuard Labs. CISA has not published details of the confirmed attacks.
Not sure which runtimes are hiding in your containers? Contact Nextek IT to book a call and we will inventory the Node.js versions, patch levels and exposed services in your environment as part of our cybersecurity services work.