Node.js security update: What you should know about Node2Shell
The Brotli vulnerability CVE-2026-111497 and additional Node.js issues have been fixed. Check your runtimes, applications and containers.
What happened?
On October 21, 2026, the Node.js project released security updates. These address CVE-2026-111497, often called Node2Shell: A flaw in the bundled Brotli decoder can corrupt process memory. If an application decompresses specially crafted Brotli data, the consequences can include crashes, disclosure of memory contents or remote code execution.
Exposure depends on your application: It must decompress attacker-controlled Brotli data. This does not mean that every internet-facing Node.js application is automatically exploitable through the same path.
Which versions include the fix?
Security releases are available as Node.js 22.23.4, 24.22.1 and 26.12.1. Use at least the fixed release for your supported branch. The release also addresses other issues, including DNS resolution and TLS certificate verification.
What should you do on your cloud server?
- Inventory all Node.js installations: on the server, inside containers and in build environments.
- Update the runtime, then restart your applications using the new version.
- With Docker, rebuild images using a patched base and recreate your containers. Updating the host alone does not update existing images.
- Test your applications after updating. Updating npm packages alone does not replace the Node.js runtime update.
- If your release branch is no longer supported, plan migration to a supported version.
Need help?
Contact the Key2Host Helpcenter and include your service, Node.js version and container image, if applicable. This notice does not confirm an individual service's patch status or a security incident at Key2Host.
Information current as of October 24, 2026.