Security updates for Node.js were released this week to address a high-severity flaw in its Brotli decompression process, a vulnerability now identified as Node2Shell (CVE-2026-111497). Discovered on Wednesday, this issue could allow attackers to remotely execute code, crash applications, or leak memory. The critical updates impact various Node.js versions and the Bun JavaScript runtime.
The vulnerability specifically targets how Node.js decompresses Brotli data, a common compression format used by web servers and clients to reduce traffic size. According to Aikido Security, an attacker could trigger the flaw by feeding a malicious payload to an application that processes controlled Brotli data. This can occur either directly via the `node:zlib` module or automatically when the `fetch()` function receives a Brotli-compressed response.
Every supported Node.js release line contained this flaw before the October 21 update, as did Bun, prior to version 1.4.4. The extent of an application\’s exposure depends on the origin of its compressed data, highlighting the broad potential impact across the ecosystem, as reported by Aikido Security.
Understanding the Node2Shell Vulnerability
CVE-2026-111497 is technically an out-of-bounds write within the Brotli decoder, which can be activated by malformed compressed input. In essence, the decoder can be manipulated into writing data beyond its allocated memory buffer, a classic method for inducing system crashes and enabling remote code execution. Node.js has rated this flaw as high severity, just below critical, underscoring its potential for significant security breaches.
Brotli is a compression library developed by Google, and Node.js ships with its own integrated copy. The specific vulnerability resides in this bundled code, meaning the solution requires updating the Node.js runtime itself. The fix, an upstream patch from the Brotli project (commit 0ed4268a from February), allows the decoder to identify invalid input and halt processing before it can write beyond the buffer. This same fix was incorporated into Brotli versions 1.2.1, 1.1.1, and 1.0.10, suggesting that other software utilizing bundled Brotli libraries may also require updates.
Urgent Updates and Broader Implications
Users of Node.js are strongly advised to update promptly to version 22.23.4, 24.22.1, or 26.12.1, depending on their active release line. Heise online emphasized the urgency, noting that all end-of-life (EOL) Node.js versions are also affected, and users of these unsupported lines should migrate to a current, supported release. Bun users should upgrade to Bun 1.4.4 or a newer version to incorporate the necessary fix.
Beyond self-managed installations, organizations using managed platforms that bundle their own Node.js runtime must verify their provider\’s current version, as these platforms might lag behind upstream releases. Similarly, if Node.js was installed via a Linux distribution package (such as Debian, Ubuntu, Fedora, RHEL, or Alpine), the fix may arrive through the distribution\’s Brotli package, necessitating a check of the relevant security advisories. The widespread use of Node.js means this `Node2Shell` vulnerability could disrupt critical online services globally, impact data integrity, and lead to substantial financial losses across international markets, making the update process a global security imperative.
Heise online also noted that the recent Node.js updates address an additional ten security vulnerabilities within Node.js itself, including high-severity issues affecting TLS connection certificate verification and DNS name resolution. Furthermore, the updates incorporate newer versions of underlying projects like OpenSSL and SQLite, blocking compromised eMudhra certificates and adding a list of blocked intermediate certificates to enhance TLS security against revoked public keys.
The rapid patching of the Node2Shell vulnerability underscores the continuous need for vigilance in software supply chains. Organizations should prioritize immediate updates to all affected Node.js and Bun environments, especially those handling external compressed data. Monitoring official Node.js advisories and distribution-specific security bulletins will be crucial for maintaining secure operational integrity.
Image: Aikido Security
Sources consulted
- Aikido Security: Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix
- The Hacker News: Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data
- heise online: Node.js fixes its own and inherited security vulnerabilities
Adrian Velk is a global affairs journalist focused on breaking news, geopolitics, and societal trends. With a sharp eye for detail and a commitment to accuracy, he delivers timely reporting that helps readers understand the fast-moving world around them. His work blends factual depth with clear storytelling, making complex events accessible to a broad audience.
