Node2Shell and the npm attacks: what to check in your Node.js apps
By Shayan Parsai · Published · 2 min read
Node2Shell is CVE-2026-111497, a flaw in the Brotli decoder that ships with Node.js. It can crash an app, leak memory or run code. Node.js fixed it on 21 October 2026 in versions 22.23.4, 24.22.1 and 26.12.1, and CISA added it to its list of exploited flaws on 27 October. Your risk depends on whether your app unpacks Brotli data from untrusted sources.
Lessons from this story4 points ▾
- Update Node.js itselfMove to 22.23.4, 24.22.1 or 26.12.1 or newer. Akamai says upgrading is the only complete fix, and old release lines get no patch.
- Find what unpacks BrotliApps that decompress untrusted Brotli are exposed. Akamai names the built-in fetch() and Express 5 as examples to check first.
- Slow down new packagesInstall from lockfiles and wait a few days before taking new versions, as Safeguard recommends after the October wave.
- Treat a hit as a breachAikido says a machine that ran the bad tensorlake version should count as compromised. Rotate every secret that was on it.
What happened
On 21 October Node.js shipped fixes for ten flaws, four of them rated high. The one that got a name was CVE-2026-111497. Malformed compressed data can write past the end of a small buffer in the Brotli decoder, and the result can be a crash, leaked memory or remote code execution.
Node.js rates it high. Akamai gives it a CVSS score of 9.2, which is critical. CISA added the flaw to its catalogue of exploited vulnerabilities on 27 October, with a federal deadline of 10 November.
Who is exposed
Not every Node.js app. The flaw needs an app that unpacks Brotli data an attacker can control. Akamai lists three common routes: direct use of the Brotli functions in zlib, the built-in fetch(), which unpacks Brotli responses by itself, and Express 5 with body-parser 2, which unpacks request bodies by default. A plain Node.js HTTP server doesn’t unpack incoming Brotli on its own.
All supported release lines were affected. Akamai says 61% of the networks it monitors run an affected version, and that lines past end of life, such as 20.x, get no fix.
The npm attacks in the same month
On 8 October a hijacked version of the npm package tensorlake, 0.5.144, was published. Aikido describes a variant of the Shai-Hulud worm that steals cloud keys, SSH keys, browser logins and crypto wallets as soon as the package installs.
It was one of many. Safeguard counted 112 malware advisories in GitHub’s database between 26 and 28 October, covering 96 npm packages and 10 PyPI packages.
What this means for your site
A Node.js app is mostly other people’s code. The version of Node, the framework and hundreds of packages all run with the same rights as your own code, so a flaw in any of them is a flaw in your app.
Three checks worth doing this week:
- Run node -v everywhere the app runs, including containers and build servers.
- Search your code for Brotli, fetch() against outside services and Express 5.
- Use npm ci in builds, and keep secrets out of the machines that install packages.