Node2Shell: is your website actually patched?

What changed

Node.js is software that runs many web applications. Node2Shell is a common name for CVE-2026-111497, a flaw in its bundled Brotli decoder. Brotli compresses data; a decoder unpacks it.

The Node.js project says malicious compressed input can corrupt memory when an application unpacks it. Possible consequences include a crash, exposure of data held in memory, or an attacker running code. The security updates dated 2026-10-21 are Node.js 22.23.4, 24.22.1 and 26.12.1.

Ask your maintainer to install a Node.js version that includes the security patch and is still supported. If your provider supplies the software, ask for its security bulletin and confirmation that the patch is included in your live application. The “runtime” is the software that runs the app.

TheTip.ai’s 26 October newsletter brought this story to our attention. We checked the original advisories to establish what an owner needs to confirm.

Newsletter discovery: TheTip.ai, 26 OctoberNode.js: October security advisory and fixed releases

Check the version running in your app

Scalingo’s bulletin explains a gap: offering Node.js versions that include the security patch does not update an app already deployed. Its customers must select a runtime containing the patch, rebuild and redeploy, then verify the version. Restarting the existing deployment does not replace that runtime.

Other hosts may handle updates differently. Ask whether your provider updates running apps automatically or needs your developer to act. Its answer should identify your application.

Scalingo: what its customers must update and verify

Three answers that close the task

Keep a short maintenance note with these three answers. You can then see whether the work is complete without needing to understand the attack technique.

Exposure depends on what the app unpacks

Red Hat’s advisory says exploitation requires an application to decompress Brotli data supplied by an attacker. The flaw also affects software beyond Node.js, so a Node-only answer may be incomplete where other affected software is in use.

Scalingo identifies two relevant paths: incoming compressed data and compressed responses fetched from another server. Serving compressed pages to visitors does not, by itself, invoke the vulnerable decoder. An inbound filter therefore does not answer every exposure question.

Ask the maintainer to identify the running software and follow its vendor’s guidance. If the service is confirmed unaffected, retain that explanation. If the provider has not yet installed the update, ask what temporary protection applies and agree when to check again. Keep the task open until you receive confirmation.

Red Hat: affected software and exposure conditionsScalingo: incoming and outgoing decompression paths

A message you can adapt

Suggested message to your developer or host: “Please check our website and connected app services against CVE-2026-111497. Tell me which components are affected, who is applying the fix, and whether our live deployment already includes it. Please confirm the runtime or provider patch reference after the update, and check the main customer journey. If action is still pending, give me the next update time.”

This is a suggested request. Adapt it to the services your business uses.

Send the request to the person who maintains the app. If nobody is responsible for maintenance, agree who will handle future updates and support.

How forvertz agrees application maintenance and support