The Node.js project has shipped security releases for its 22.x, 24.x and 26.x lines, and one of the fixes closes a high-severity out-of-bounds write in the Brotli decoder that permits remote code execution, CVE-2026-111497. Update Node.js to 22.23.4, 24.22.1 or 26.12.1 (or a later release of the same line), then restart every Node.js process, because a process that is already running keeps the old code until it restarts.
Everything below comes from public sources, checked on 25 October 2026, and Bitvea has not tested these steps on a client system for this incident.
What do "node2shell" and "http2shell" mean?
node2shell and http2shell are nicknames, and neither appears on any official page we read for this post. The Node.js advisory, the Node.js release notes and the Brotli project's releases use the CVE number and a plain description instead.
node2shell most likely refers to CVE-2026-111497. The Node.js advisory names it "Node.js Brotli decoder out-of-bounds write permits remote code execution" and rates it high. A flaw in Node.js that can end in running an attacker's code fits the nickname, but that link is our reading, not something a source states.
http2shell we could not identify. We looked for a flaw in the HTTP/2 implementation in the October 2026 Node.js advisory and found none, and no source we read uses the name. If you have a link that uses the name, check it against the advisory before acting on it.
Is your Node.js affected?
You are affected if you run Node.js 22.x, 24.x or 26.x below the fixed release of that line, or any end-of-life version. The advisory said the releases would be available "on, or shortly after, Wednesday, October 21, 2026".
Release line | Fixed in | Source |
|---|---|---|
22.x | 22.23.4 | |
24.x | 24.22.1 | |
26.x | 26.12.1 |
Versions past their end of life are not on that list, and the Node.js advisory says: "End-of-Life versions are always affected when a security release occurs."
To find the version you run, ask the place where the code runs, not your laptop.
- On a server or virtual machine: log in and run node -v.
- In a Docker container: open the Dockerfile and read the tag on the FROM line (for example node:22), then run node -v inside a running container, because a short tag such as node:22 points at whatever release was current when the image was built.
- On a managed platform: open the project settings and find the Node.js runtime version. We have not checked how any particular provider handles this release.
How do you update Node.js?
The update itself is a new Node.js binary; how you get it depends on how Node.js got onto the machine.
- Installed with a version manager such as nvm: install the fixed release of your line (for example nvm install 22.23.4), make it the default, and point your service at it.
- Installed from your Linux distribution or a package repository: update the package. A distribution can ship the fix under its own version string, so compare against its security notice rather than against the numbers above. We have not checked any distribution's package for this CVE.
- Docker: change the FROM line to the fixed release (for example node:22.23.4) or rebuild with a fresh pull of your tag, push the image and redeploy every service that uses it. A rebuilt image on a registry changes nothing until the containers are replaced.
- Managed platform: set the runtime to the fixed release, or redeploy if the platform picks the latest patch release for you. Read the provider's own notice for what it has done.
Do the internet-facing services first: the public API, the website, anything that fetches or receives data from outside.
Restart and check the version
Installing the update is half the job, because every Node.js process started before the update still runs the old code.
- Restart every service that runs Node.js: systemctl restart for a systemd unit, pm2 restart all for PM2, or replace the containers for Docker and Kubernetes.
- Run node -v again in the same place you checked before, and confirm it shows the fixed release or newer.
- Check background workers, scheduled jobs and build agents too. They run Node.js just as much as the web server does and are easy to forget.
The same rule held for the PHP flaws earlier this month; our PHP update guide walks through it for PHP-FPM and Apache.
Does the Brotli flaw reach beyond Node.js?
Possibly, because the flaw sits in the Brotli library itself, not only in Node.js. Node.js fixed CVE-2026-111497 by taking a commit from the Brotli project into its own bundled copy of the library; the 22.23.4, 24.22.1 and 26.12.1 release notes carry it under "deps: brotli".
The Brotli project also published its own releases. The 1.2.1 release names CVE-2026-111497, and the 1.1.1 and 1.0.10 releases describe an out-of-bounds write that "permits remote code execution".
So any software that carries its own copy of the Brotli library may need its own update from its vendor. List what you run that decompresses Brotli data, such as language libraries, proxies or image and file tools, and check each vendor's notice. We have not checked any vendor beyond Node.js and the Brotli project.
What we could not verify, and where the facts come from
These points were asked of the sources and not confirmed, so the post does not state them:
- any HTTP/2 flaw in the October 2026 Node.js releases, which is what "http2shell" might suggest;
- whether there is a workaround; the advisory text we read did not offer one, so we do not suggest one;
- an NVD description, the affected Brotli versions or a CVSS score for CVE-2026-111497;
- which Node.js functions reach the flaw, or how it is triggered;
- whether Node.js 20 is past its end of life, which the release schedule page did not show;
- whether the flaw is being exploited;
- who reported it.
Sources, all read on 25 October 2026: the Node.js October 2026 security releases, the Node.js 22.23.4, 24.22.1 and 26.12.1 release notes, and the Brotli 1.2.1, 1.1.1 and 1.0.10 releases. The facts here are from public sources; Bitvea has not tested these steps on a client system for this incident.
If your team needs a hand, our penetration testing work includes help implementing fixes or reviewing the ones you have made.
Part of a topic guide
