Security Advisory: Node.js Brotli Vulnerability "Node2Shell" (CVE-2026-111497)

Date: 26th October, 2026

On 21 October, Node.js released security updates for a new vulnerability, CVE-2026-111497, in Node.js's built-in Brotli decompression. Researchers have since shown that it can let an attacker run code on a server. They call it "Node2Shell". Node.js rates it high. There are no reports of this vulnerability being exploited so far.

This advisory only applies if you run Node.js. If your site runs only on PHP (for example, Magento or Shopware) and you do not run Node.js, no action is needed.

Who is affected

A site is affected if both of these are true:

• It runs Node.js 22, 24 or 26 older than the fixed versions below, or Node.js 20 or older.
• The application decompresses Brotli data that comes from outside. The common ways this happens are:
  • Express 5 body parsers, such as express.json(), which accept Brotli-compressed request bodies.
  • fetch() calls to servers you do not control. Node.js decompresses Brotli responses automatically.
  • Code that decompresses user-supplied data with Node.js's Brotli functions.

A plain Node.js server does not decompress request bodies by itself. The flaw is only in decompression. Using Brotli to compress your pages, as most sites and CDNs do, is not affected.

Other software with the same flaw

The same Brotli bug also affects other software. If you use any of these, please update them too: 
Bun (fixed in 1.4.4), the Python Brotli package (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0).

What happens next

If Webscale manages Node.js on your servers, we will update it and confirm with you. If you manage Node.js yourself, please update it, or open a ticket and we'll help.

Further support

If you have any questions about this advisory, please reach out to our support team through your customer portal or by emailing support@webscalenetworks.com.

References

• Node.js October 2026 security releases: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• The Hacker News, Node2Shell research: https://thehackernews.com/2026/10/researchers-demonstrate-node2shell-rce.html