Node2Shell (CVE-2026-111497): how to patch Node.js, Next.js and Bun

Node2Shell is CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js. According to Node.js (2026), crafted data can cause an out-of-bounds write and remote code execution. Node.js rates it high. Node.js 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026, fix it, and so does Bun 1.4.4.

Brotli is a compression format servers use to shrink web traffic. Node.js decompresses it on its own when fetch() receives a compressed response or when Express 5 accepts a compressed request. Next.js, Nuxt, NestJS and most of today's JavaScript APIs run on Node.js. That is why the flaw reaches many applications that never call Brotli directly.

What Node2Shell is and how dangerous it is

Crafted data can trick the Brotli decoder in Node.js into writing past the end of a memory buffer. That is a classic route to a crash and to running someone else's code. Vercel writes that researchers demonstrated process memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x. The code then runs with the permissions of the process, which means the permissions of your application.

A Node.js application usually holds everything it needs in memory and in its environment variables: the database password, keys for Stripe, email, cloud and AI model APIs, session tokens of logged-in users. Memory disclosure alone can be enough to leak some of them, even without a full takeover.

Three things make this flaw dangerous:

• The attack needs no login. It takes one crafted request to a server running Express 5, or a compressed response planted on a server your application fetches from.
• The exploit works on official builds. Imperva ran code on the official, unmodified Node.js 24.22.0 Linux arm64 image.
• Some applications will never get the fix. Lines 25.x, 23.x, 20.x and earlier are end of life.

What can happen to your company: examples

A customer data breach also has legal consequences in the EU. Under the GDPR (2016), a company has 72 hours after becoming aware of a breach to report it to the supervisory authority. Under the GDPR (2016), failures in security and breach notification can be fined up to €10 million or up to 2% of total worldwide annual turnover, whichever is higher. Source: GDPR, Regulation 2016/679, Article 33 and Article 83(4).

Node2Shell in numbers: statistics 2026

Figures checked on 23 October 2026.

• According to W3Techs (2026), Node.js serves 7.4% of websites whose web server is known.
• According to W3Techs (2026), Next.js, which runs on Node.js, is on 3.7% of all websites.
• According to Vercel (2026), the same Node.js releases fix 9 other issues, including 2 high-severity TLS hostname verification bypasses.
• According to Imperva (2026), the attack worked against Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0, though it took several attempts.
• According to Aikido (2026), citing The Hacker News, no exploitation outside labs had been reported as of 22 October.

Sources: Node.js, 21 October 2026 security releases, Vercel, W3Techs, Node.js, W3Techs, Next.js, Imperva, Aikido.

Next.js, Express and fetch(): how the attack gets in

Vercel notes that Node.js does not decode Brotli data on its own. An application is exposed when its code, or a library it uses, decompresses Brotli data an attacker controls. The common routes:

Next.js on Vercel: Vercel patches the 22.x and 24.x runtimes itself, and its WAF blocks the inbound attack. Projects on Node.js 20.x must switch to 22.x or 24.x and redeploy. Next.js on your own server, in Docker or with another provider has to be upgraded by you.

Which Node.js versions are affected and which are fixed

The same Node.js releases also update the root certificates and remove trust in the compromised eMudhra certificates, so one upgrade closes both problems.

If your Node.js comes from a Linux distribution package, such as Debian, Ubuntu, Fedora or Alpine, it may use the system Brotli library. Then the fix arrives with your distribution's Brotli package. The Brotli project shipped the same fix in 1.2.1, 1.1.1 and 1.0.10.

How to patch Node2Shell: step by step

1. Run node --version on servers, in CI, on the team's laptops and inside every container image.
2. Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, depending on the line.
3. Move pinned image tags. An image pinned to node:24.22.0 stays vulnerable however often you rebuild it.
4. Rebuild images and redeploy.
5. Check the version inside the running containers in production.
6. Upgrade Bun to 1.4.4 or newer.
7. Move applications off Node.js 25.x, 23.x, 20.x and earlier to a supported line and run the tests.

Commands:

node --version                           # server, laptop, CI machine
docker run --rm <image> node --version   # every container image
npm ls express body-parser               # Express 5 and body-parser 2.x
grep -rn "brotliDecompress\|createBrotliDecompress" src/   # Brotli calls in your code
docker build --pull --no-cache -t <image> .               # rebuild on a fresh base

A package inventory can miss a Node.js runtime bundled inside an image, so check the version in the image itself. Managed platforms that ship their own Node.js can lag behind. Check which version your provider runs.

What to do if you cannot upgrade today

The Node.js advisory lists no workaround. Aikido describes two ways to reduce exposure:

• Reject requests with Content-Encoding: br at the reverse proxy, the load balancer or in application middleware.
• Turn on edge rules where your platform has them. Vercel added rules on 21 October, and Imperva added its own WAF rules.

Neither covers Brotli responses your application fetches from other servers. Vercel states plainly that only the runtime patch covers fetched responses.

How Syntalith helps patch Node2Shell

We have already done it on our own systems. On 23 October we moved our Next.js website, booking system and MCP server to Node.js 24.22.1, then checked the version inside the running containers.

We do the same for clients, from the service list to the final check. First we list Node.js and Bun on servers, in CI, in container images and at platform providers. Then we upgrade the services that accept requests from the internet or fetch data from outside servers first, self-hosted Next.js included. We move pinned image tags, rebuild and redeploy. Applications on Node.js 20.x, 23.x and 25.x go to a supported line, and we run the tests to check they still work.

Finally we check the version in production and give you a written report: what was vulnerable, what we upgraded, what remains. We work on your infrastructure, with access only for the duration of the job.

Start with a free 30-minute call with an engineer. Tell us where Node.js runs, and we will tell you where to start and how long it will take. Book a call.

The same week brought the PHP2Shell flaws in PHP and the eMudhra certificate compromise.