Security Bulletin

❓What:

• On October 21, Node.js released security updates for CVE-2026-111497, nicknamed Node2Shell.

• Node.js is another widely used behind-the-scenes web technology. It powers many websites, apps, and online services.

• The flaw is in the Brotli decoder, the component that unpacks compressed data. A specially crafted file could let an attacker run code, crash the service, or read memory.

• It’s rated high severity. Public proof-of-concept code exists, but published exploits are unreliable and depend heavily on the environment.

• Source Arctic Wolf is not aware of active exploitation.

⚠️Impact:

• Affects Node.js 22.x, 24.x, and 26.x before the fixed releases, plus end-of-life versions like 20.x, 23.x, and 25.x.

• Node.js 20 and older receive no fix. konfirmity

• The highest risk is internet-facing services that process Brotli-compressed data from outside users.

• Many vendor products bundle Node.js, so some fixes will depend on vendors shipping their own updates.

• Researchers have published enough technical detail that a capable attacker could build a more reliable exploit.

💡Recommendations:

• Upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1 or later.

• Rebuild containers and images that include older Node.js versions. Updating the host alone won’t fix them.

• Move anything on end-of-life Node.js to a supported release.

• Prioritize public-facing services first.

• Watch vendor advisories for products that bundle Node.js, and ask your key vendors when they will patch.

Read the full story HERE