Node2Shell and the Node.js October 2026 Security Release: What to Update

In the same week as the PHP2Shell bugs, Node.js shipped a security release that fixed 10 vulnerabilities. The most important one is a bug in Node's built-in Brotli decompression code. Researchers nicknamed it Node2Shell (some call it HTTP2Shell), and on 27 October 2026 CISA added it to its list of bugs that attackers are actively using.

If you build anything with Node.js, from a college MERN project to a production API, this post explains what was fixed, whether your app is affected and how to update in a few minutes.

Last updated: 28 October 2026.

💡 Quick answer: The Node.js security release of 21 October 2026 fixed 10 CVEs. The most serious, CVE-2026-111497 (Node2Shell), is an out-of-bounds write in the Brotli decoder that can crash a Node process, leak memory or let an attacker run code. It can be reached through fetch(), the zlib Brotli functions and Express 5's body parsers. The fixed versions are Node.js 26.12.1, 24.22.1 and 22.23.4. Lines 25.x, 23.x, 20.x and older get no fix, so move to a supported line.

💡 Who is this guide for? Students and developers who use Node.js, Express, Next.js or any JavaScript backend, and want to know exactly what to update.

In this guide:

1. What Was in the October 2026 Release?
2. Node2Shell in Simple Words
3. Is Your App Affected?
4. All 10 CVEs at a Glance
5. Fixed Node.js Versions
6. How to Update Node.js Quickly
7. If You Use Express 5
8. Do Not Forget Docker, CI and Hosting
9. Timeline
10. Why npm audit Did Not Warn You

---

What Was in the October 2026 Release?

On 21 October 2026, the Node.js project released new versions of all three supported lines: 26.x, 24.x and 22.x. Together they fixed 10 CVEs:

A security release like this is normal for a big project. Node.js publishes them regularly, and each one is a reason to update, not a reason to panic. This one deserves extra attention because of Node2Shell.

---

Node2Shell in Simple Words

Brotli is a compression format, like ZIP or gzip but newer. Websites use it to make files and API responses smaller, and many HTTP clients and servers decompress it automatically. Node.js includes Google's Brotli decoder inside the runtime.

The bug: when the decoder received a certain kind of broken compressed data, it did not treat it as an error. It treated it as "I need more data" and kept writing incoming bytes into a small 8-byte buffer, past its end. Writing past the end of a buffer can overwrite other memory in the process.

What that can lead to:

• A crash, which takes your app offline until it restarts
• A memory leak, where data from inside the process (possibly secrets) is exposed
• Remote code execution, where the attacker runs their own code inside your Node process

Node.js rates the bug High. Akamai scored it 9.2 (critical), and Rapid7 also treats it as critical. On 24 October, researchers at Imperva showed code execution against an unmodified Node.js 24.22.0, the last version before the fix. On 27 October, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog, based on evidence of active exploitation.

💡 Pro Tip: The bug is in the decoder, so the attacker's only job is to get your app to decompress their data. They do not need a login, and your code does not need to call any Brotli function by name.

---

Is Your App Affected?

Your app is at risk if it runs an unfixed Node.js version and decompresses Brotli data that someone else controls. Here are the common ways that happens:

Figure 1: The common paths by which attacker-controlled Brotli data reaches the decoder in a Node.js app.

It is not only Node.js. The same Brotli decoder is copied into many other projects. Fixed versions are out for the Python Brotli and brotlicffi packages (1.2.1 and 1.2.1.0, often installed alongside requests, urllib3, httpx or aiohttp), Bun (1.4.4), and PHP's Windows builds (the new -1 builds published on 26 October). Envoy and Istio also shipped fixes for setups that enable Brotli decompression. If your stack includes any of these, update them as well.

---

All 10 CVEs at a Glance

Here is every fix in the release, in plain words. "Lines" shows which supported Node.js lines had the bug.

The full technical notes are on the official Node.js October 2026 security releases page.

---

Fixed Node.js Versions

Node.js 20 reached end of life in April 2026, and Node.js 18 in April 2025. If any of your projects or servers still use them, this release is a strong reason to move.

💡 Pro Tip: Do not use process.versions.brotli to check if you are safe. Fixed Node.js releases can still report Brotli 1.1.0 or 1.2.0 there. The Node.js version number (node -v) is the reliable check.

---

How to Update Node.js Quickly

First, check your version:

bash
Copy
1node -v

If it is lower than the fixed version for your line, update:

After updating, run node -v again to confirm, then restart every Node process (PM2, systemd services, dev servers) so the new runtime is actually in use.

---

If You Use Express 5

Express 5 apps are the most exposed group, because body-parser 2 decompresses Brotli request bodies by default. The real fix is still to update Node.js. If you need a stop-gap for a few hours, you can turn off decompression for request bodies:

js
Copy
1app.use(express.json({ inflate: false }));
2app.use(express.urlencoded({ extended: true, inflate: false }));

With inflate: false, compressed request bodies are rejected with HTTP 415. Browsers and most API clients never compress request bodies, so most apps will not notice a difference. Test any webhooks you receive before you ship this, and remove it once Node.js is updated if you prefer the default.

Also pin your Node.js version where your app is deployed, so a future build cannot fall back to an old runtime. In package.json:

json
Copy
1{
2  "engines": {
3    "node": ">=24.22.1 <25"
4  }
5}

---

Do Not Forget Docker, CI and Hosting

Updating Node.js on your laptop is only half the job. Check every place your code runs:

• Docker images. Rebuild with a fresh base image, for example docker build --pull . with FROM node:24-alpine, then redeploy. An old image keeps the old Node.js forever.
• Hosting platforms. Render, Railway, Vercel and similar platforms choose a Node.js version from your settings or the engines field. Check the build log for the version actually used, and trigger a new deploy after you change it.
• CI pipelines. Update the Node.js version in GitHub Actions (actions/setup-node) or your CI config so tests run on the fixed version.
• Serverless functions. Check the runtime setting of each function and redeploy.
• Electron and desktop apps bundle their own Node.js, so they need their own update from the app's vendor.

---

Timeline

That first line is an interesting lesson. The code fix existed publicly for about eight months, but because nobody labelled it as a security fix, the many projects that copy Brotli into their own code had no reason to update.

---

Why npm audit Did Not Warn You

Many developers rely on npm audit to tell them about security problems. It is a great tool, but it only checks the packages in your package-lock.json. Node2Shell is in Node.js itself, so npm audit could not see it.

That is why a complete security routine has two parts:

1. Your dependencies: run npm audit and turn on GitHub Dependabot alerts.
2. Your runtime: keep Node.js on a supported LTS line and update it when a security release comes out. You can follow the Node.js vulnerability blog for every announcement.

---

Final Thoughts

The October 2026 Node.js release fixed 10 bugs, and one of them, Node2Shell, is already being used by attackers. The fix is quick: update to Node.js 26.12.1, 24.22.1 or 22.23.4, restart your processes, and rebuild your Docker images and deployments. If you use Express 5, add inflate: false as a short stop-gap only until the update is done.

Learning to read a security release and update a production app calmly is a real backend skill. If you want to practise it on real projects with reviews from a team, you can do a free internship at MetaSkillGroup. Our backend development internship is online, open all year and free to apply. It takes about 2 minutes to apply, and your first exam attempt is free.