XDEFENSE Node2Shell Exposure Check
CVE-2026-111497 · Brotli RCE · Version check

Is your Node.js patched
against Node2Shell?

Node2Shell (CVE-2026-111497) is a critical remote-code-execution flaw in the Brotli compression library bundled inside Node.js — an out-of-bounds write reachable through attacker-controlled Brotli data. This check reads the Node.js version your service reports, compares it to the fixed releases, and emails a signed PDF verdict. It reads the version only.

⚠ 9.2 (CVSS v4.0, Critical) 🔒 Your own domain only ✉ Work-email verification 🛡 reCAPTCHA protected
Setup incomplete. Missing in config/.env: SMTP_HOST, SMTP_USERNAME, SMTP_PASSWORD, MAIL_FROM, RECAPTCHA_SITE_KEY, RECAPTCHA_SECRET. Copy config/.env.example to config/.env and fill it in. See docs/SMTP-SETUP.md.
Run the check
https://
Enter a public URL you are responsible for. One normal request is sent to read its version header.
Must be on the same domain as the URL. Free providers are rejected.
Node
Node apps rarely expose their version, so this is usually required. Run node -v on the server.
⚠reCAPTCHA is not configured. Set RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET in config/.env.
Result is emailed to your work address as a PDF.
What has been discovered

What is Node2Shell

Node2Shell is CVE-2026-111497, an out-of-bounds write in the Brotli decompression library that Node.js bundles. When Node decompresses attacker-controlled Brotli data, the flaw permits remote code execution. It headlined a Node.js security release that fixed 10 CVEs in total (4 High, 3 Medium, 3 Low). End-of-life Node.js lines received no fix and remain exposed.

CVE-2026-111497Brotli decoder · High

Node2Shell — an out-of-bounds write in the Brotli decompression library bundled with Node.js, reachable when decompressing attacker-controlled Brotli data. It permits remote code execution and is the headline flaw of the October 2026 release.

3 further High CVEsSame release

CVE-2026-105482, CVE-2026-106069 and CVE-2026-105483 are three more High-severity issues fixed in the 21 October 2026 release, alongside three Medium and three Low CVEs. See the Node.js security advisory for the full technical list.

The findings

Affected & fixed releases

Supported lines are fixed in 22.23.4, 24.22.1 and 26.12.1 (released 21 Oct 2026). Node.js 20 (EOL Apr 2026), 25 (EOL Jun 2026), 21, 23 and older receive no fix and are always affected. Rebuild container images from a patched base.

LineFixed releaseStatus
Node 2222.23.4Supported
Node 2424.22.1Supported
Node 2626.12.1Supported
Node 20, 25, 21, 23 & olderno security fixEnd-of-life
How it works

Four gated steps

1 · Verify

Work-email domain must match the site's domain; confirm permission; pass reCAPTCHA.

2 · Read version

One ordinary request reads the version from the response headers. Never the exploit.

3 · Assess

The version is compared to the fixed releases per line, giving one clear verdict.

4 · Deliver

A branded, dated PDF is emailed to the verified work address.

Disclosure timeline

How it unfolded

  1. 30 Apr 2026Node.js 20 reached end-of-life. End-of-life lines are always affected when a security release occurs, because the fixes are never backported.
  2. 1 Jun 2026Node.js 25 reached end-of-life, joining 21 and 23 as unsupported odd-numbered lines.
  3. 21 Oct 2026Node.js published a security release across all supported lines — 22.23.4, 24.22.1 and 26.12.1 — fixing 10 CVEs (4 High, 3 Medium, 3 Low). It is headlined by CVE-2026-111497 ("Node2Shell"), an out-of-bounds write in the bundled Brotli decoder that permits remote code execution.
  4. 21 Oct 2026End-of-life lines (20, 21, 23, 25 and older) received no fix and remain affected. No workarounds were published.
Need deeper coverage?

For a full assessment beyond this version check — configuration, exposed endpoints and remediation support — talk to the XDEFENSE team.

✉ letstalk@xdefense.io
Primary sources
CVE-2026-111497 Node.js security blog nodejs/node Node.js previous releases (EOL)