X
October 23, 2026
Node.js shipped security updates on October 21, 2026 to fix CVE-2026-111497, a high-severity flaw in its Brotli decoder that can allow remote code execution. The fix is an updated Node.js runtime. Contrast can help you buy time with a virtual patch, but it is a stopgap and not a replacement for patching.
Node2Shell is the name attached to an out-of-bounds write in the Brotli decoder built into Node.js. Because the flaw lives in the runtime itself, patching an application or a package will not remove it. Teams need to update Node.js and restart their processes.
The flaw is high severity and can permit remote code execution. Fixed releases are Node.js 26.12.1, 24.22.1, and 22.23.4. End-of-life Node.js versions are affected and will not get a fix. A Contrast virtual patch can block one inbound request path while you schedule the update, but it does not cover every way the decoder can be reached.
Brotli is a compression format that Node.js can decode when handling HTTP traffic. In this case, a memory error in the decoder can let an attacker write outside the bounds of a buffer, and that can lead to running code on the host. The name Node2Shell reflects the worst case, which is an attacker going from a crafted payload to a shell.
The numbers here are small but telling. One CVE affects the runtime, and three supported release lines carry the fix. The same releases also address nine other vulnerabilities and refresh the trusted certificate authority list, so skipping the update leaves more exposed than this single flaw.
Critical business consequences could include:
Remote code execution on a server can mean data theft, lateral movement into other systems, and downtime while teams investigate. Any internet-facing Node.js service is the first place to look.
Node.js has not published a workaround, indicators of compromise, or details on how the flaw is triggered, so what follows is limited to what is known.
The known path involves a request that reaches the Brotli decoder. Applications on Express 5 or body-parser 2.x decompress a request body when the header Content-Encoding is br, and that runs the vulnerable decoder. Other routes exist too, such as a malicious response decoded by fetch() or a direct call to zlib.brotliDecompress().
Updating a runtime is harder than updating a library. It touches hosts, container base images, and hosting providers, and each has its own release schedule. Processes must also be restarted before the fix takes effect.
Static analysis looks at your code, and software composition analysis looks at your dependencies. A flaw in the runtime's built-in decoder sits outside both, so a clean scan does not mean you are unaffected. The only reliable check is the version of Node.js actually running.
Details of exploitation are not public, so we cannot say how any given WAF will behave. What we can say is that a compressed body is decoded inside the runtime after it passes the perimeter, which makes a WAF an unreliable control for this flaw. Treat it as a layer and not as the fix.
Contrast protects application code by watching how untrusted data reaches things like SQL queries and system commands. A memory flaw inside the runtime happens below that layer, so the complete fix is an updated Node.js build. Contrast does offer a way to reduce exposure in the meantime.
If you cannot patch right away, a virtual patch in the Contrast Node.js agent, version 5.67.1 or later, can block one path to the flaw. Create a virtual patch on the content-encoding request header with a Matches condition using the regular expression (?:^|,)\s*br\s*(?:;[^,]*)?(?:,|$), and run ADR/Protect in blocking mode. Requests carrying Brotli encoding are then stopped before the body is decoded.
This is a stopgap. It covers the inbound request path only, and it blocks all Brotli request bodies, including legitimate ones. Updating Node.js remains the complete fix.
.png?width=1008&height=625&name=image%20(1).png)
Addressing Node2Shell takes a systematic approach beyond simple scanning. These five steps keep the work organized.
Find every place Node.js runs, including build servers, container images, serverless functions. Record the running version for each.
Prioritize by exposure. Internet-facing services that accept request bodies, especially on Express 5 or body-parser 2.x, come first. Services that call fetch() against untrusted endpoints or use zlib.brotliDecompress() directly also deserve attention.
Update to Node.js 26.12.1, 24.22.1, or 22.23.4, starting with internet-facing systems. Update the runtime itself, restart your Node.js processes, and confirm the running version. If you use a container image or hosting provider, ask when they will ship a fixed build. Anyone on an end-of-life version needs to move to a supported release.
Where patching must wait, apply the virtual patch with Contrast as described above and keep it in place only until the update lands.
Review Node.js application logs and endpoint telemetry from October 21 forward. Look for Node.js processes starting shells, running download tools, or making unexpected outbound connections. If you find any, isolate the host and start your incident response process.
Fixes for Node2Shell are already available, but a fix that exists is not the same as a fix that is deployed. The gap usually comes from how runtimes are managed, not from a lack of patches.
Several factors contribute to ongoing exposure. Runtimes are updated less often than application dependencies. Container base images carry old Node.js builds long after teams stop thinking about them. End-of-life versions never receive fixes at all.
Attackers increasingly target the layers beneath application code, where scanners and perimeter tools have less visibility. A flaw that is reachable through an ordinary HTTP header is attractive precisely because the traffic looks routine.
Node2Shell will not be the last flaw to land below the application layer. A few habits make the next one faster to find and close.
Keep an accurate inventory of runtimes, not just packages. Know who owns each base image and how quickly it can be rebuilt. Treat stopgap controls as temporary and give them an expiry date.
Node2Shell is a reminder that some fixes cannot be delivered by an application scan or a firewall rule. The runtime needs to be updated, and the sooner the better. Contrast's own SaaS and EOP platforms run on Java and accept only gzip, so the vulnerable code path is not reachable there, and we will update affected base images as part of our normal patching cycle.
Inventory your Node.js versions today, patch internet-facing systems first, use the virtual patch only where you must wait, and review logs from October 21 onward. Questions can go to your account manager or support@contrastsecurity.com. Node.js's announcement is at https://nodejs.org/en/blog/vulnerability/october-2026-security-releases.
It is CVE-2026-111497, an out-of-bounds write in the Node.js Brotli decoder that can permit remote code execution. It is dangerous because it sits in the runtime and can be reached through ordinary request handling.
Check the version of Node.js actually running. Anything older than the fixed releases, and any end-of-life version, is affected.
The fix ships in Node.js 26.12.1, 24.22.1, and 22.23.4, one for each supported release line. End-of-life lines will not receive a fix.
Sr Product Marketing Manager & CISSP
