Node.js Vulnerability 2026: What "Node2Shell" Means for Your App

If your website or app runs on Node.js (Express, Next.js, NestJS or a custom API), this matters. On 21 October 2026, Node.js released security updates for a serious bug nicknamed "Node2Shell" (CVE-2026-111497). It comes the same week as PHP2Shell, and the fix is again a normal update.

What happened, in simple words

Node.js has a built-in tool for unpacking Brotli, a common way to compress data on the web. That tool had a bug:

• When it received a specially broken Brotli file, it thought it simply needed more data instead of rejecting the file.
• So it kept writing bytes into a tiny 8-byte memory space and wrote past the end of it.

The result: an attacker who can send your app Brotli data could crash it, read its memory, or even run their own code on your server. No password is needed. Node.js rates it high, and security researchers score it 9.2 out of 10.

Is my app affected?

Your app is at risk if it unpacks Brotli data from someone you don't control. Common ways this happens:

• Express 5 / body-parser 2: their json, text, raw and urlencoded parsers unpack Content-Encoding: br request bodies by default. A stranger can just send one.
• Built-in fetch(): it unpacks Brotli responses automatically, so calling a malicious or hacked server is enough.
• Your own code using zlib.brotliDecompress() or zlib.createBrotliDecompress() on uploads or outside data.

A plain http server doesn't unpack request bodies on its own. But Node.js offers no workaround, so the safe answer for every app, Next.js included, is: update Node.js.

Which versions are safe?

If you're still on Node 20 or older, this is your sign to move to Node 24 LTS.

Check your version

In a terminal: node -v. Or save this as check-node.js and run node check-node.js on each server:

const fixed = { 22: '22.23.4', 24: '24.22.1', 26: '26.12.1' };
const [major, minor, patch] = process.versions.node.split('.').map(Number);
const target = fixed[major];

const older = (a, b) => {
  const [x, y, z] = b.split('.').map(Number);
  return a[0] < x || (a[0] === x && (a[1] < y || (a[1] === y && a[2] < z)));
};

if (!target) {
  console.log(`Node ${major} no longer gets security fixes. Upgrade to Node 24 or 26.`);
} else if (older([major, minor, patch], target)) {
  console.log(`Vulnerable! Update Node ${process.versions.node} to ${target} or newer.`);
} else {
  console.log(`Good: Node ${process.versions.node} has the Node2Shell fix.`);
}

What to do today

1. Update Node.js on every server, then restart your app (pm2 restart all, your systemd service, or your hosting panel). The old process stays vulnerable until it restarts.
2. Rebuild Docker images. If your Dockerfile says FROM node:22 or similar, pull the new base image and redeploy. Old images keep the old Node.
3. Check CI and build servers too. They often call fetch() to download packages and data.
4. Using Bun? It had the same bug. Update to Bun 1.4.4 or newer.

Can't update today? If your Express app doesn't need compressed request bodies, turn them off. Compressed requests will then get a 415 error instead of being unpacked:

// Temporary protection until Node.js is updated
app.use(express.json({ inflate: false }));
app.use(express.urlencoded({ extended: true, inflate: false }));

This only covers request bodies, not fetch() or your own zlib code. It reduces the risk but doesn't remove it.

Quick answers

Is Next.js affected? Next.js isn't named in the advisory, but it runs on Node.js and uses fetch() on the server. Update the Node.js version your server or host uses.

Do I need to update my npm packages? For this bug, no. It lives in Node.js itself, so updating Node.js is the fix. Run npm audit anyway, as the same release fixed 9 other issues.

Will updating break my app? Updates within your line (for example 22.20.0 to 22.23.4) only contain fixes and are very safe. Moving to a new line may need small changes, so test on a copy first.

Node on my own laptop? Lower risk, but fetch() to an unknown site can still trigger it. Update it too.

For a wider safety check, read our guide to the OWASP Top 10 vulnerabilities. Need help updating your servers? Contact our team.

Sources: Node.js October 2026 security releases, Akamai: Inside Node2Shell, Konfirmity advisory.