01
Find every Node.js
Servers, container images, CI runners and serverless functions. Run node --version in each and paste it above.
Node.js fix released · 21 October 2026 · update now
Node2Shell: Node.js security update, October 2026. Is your app affected?
On 21 October 2026 Node.js released 22.23.4, 24.22.1 and 26.12.1 to fix a flaw in its built-in Brotli decoder (CVE-2026-111497) that can crash a server and potentially let attackers run code on it. Enter your domain to see whether it runs on Node.js, then paste your version below for an exact answer.
Loading the check …
We'll confirm it for you, free. We find out which Node.js your servers, containers and CI run and whether they have the fix, and update them for you if not. The first assessment is free.
We'll use your email only to answer this request. Privacy notice
Free · One normal page request, no attack traffic · Node.js never shows its version from outside, so the exact answer comes from the version check below. Last updated
Exact answer
Paste your Node.js version.
Run one of these on your server, in your container or on your CI runner, and paste what it prints. The check runs in your browser; nothing is sent to us.
- Server or laptop
node --version- Container image
docker run --rm <image> node --version- Or paste the tag from your Dockerfile
FROM node:22.23.3-alpine- Express / body-parser in your app
npm ls express body-parser- Bun
bun --version
Check every place Node.js runs: production servers, container images, CI runners, build and worker machines.
Check a whole server or project
One file, no dependencies, works on Node.js 16 and newer. It reads the Node.js or Bun that runs it (including builds that use the system Brotli library), your Express and body-parser versions, Brotli calls in your code and the FROM lines of your Dockerfiles, and prints a verdict.
- Download it, read it, then run it in your project folder
curl -fsSLO https://zybee.ai/node2shell-check.mjs node node2shell-check.mjs- Inside a container image
docker run --rm -v "$PWD":/w -w /w <image> node node2shell-check.mjs- For CI (exit code 1 = update needed)
node node2shell-check.mjs --json
Read-only: it sends nothing anywhere and starts no process. View the script
What happened
A memory bug in the Brotli decoder inside Node.js.
Node.js bundles the Brotli compression library. Malformed compressed input can make its decoder write outside its memory buffer, which can crash the process, leak memory and potentially let an attacker run code. Every supported Node.js line was affected before the 21 October update, so the fix is a Node.js update, not an npm package update.
- Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br, so any visitor can deliver one. A bare Node.js HTTP server does not do this on its own.
- fetch() (undici) decompresses Brotli responses automatically, so a malicious or compromised server can reach your app through a response: webhooks and user-supplied URLs are typical.
- Any code that passes untrusted data to zlib.brotliDecompress or createBrotliDecompress.
- Fix released
- 21 October 2026
- Fixed versions
- Node.js 26.12.1, 24.22.1, 22.23.4
- No fix
- Node.js 25.x, 23.x, 20.x and older (end of life)
- Bun
- Affected before 1.4.4
- Severity
- High (Node.js rating, one step below critical)
- Impact
- Crash, memory leak, potential remote code execution
- CVE ID
- CVE-2026-111497 ("Node2Shell")
- Exploitation
- None reported in the wild as of 22 October 2026. Researchers reported code execution on an unmodified Node.js 24.22.0 on Linux arm64, not on every attempt
Source: Aikido's write-up of the Node.js security release. Distribution packages (Debian, Ubuntu, Fedora, RHEL, Alpine) may link the system Brotli library instead; check your distribution's advisory.
What to do now
Three steps for teams running Node.js.
02
Update and rebuild
Move to 22.23.4, 24.22.1, 26.12.1 or newer, and to 24 or 26 from an end-of-life line. Rebuild container images: a pinned tag such as node:22.23.3-alpine stays affected. Restart running processes.
03
Stopgap until then
Reject requests with Content-Encoding: br at your reverse proxy, load balancer or middleware. That reduces inbound exposure only: Brotli responses your app fetches from other servers are not covered.
After the update
Node.js is one door. What else is open?
The Zybee Exposure Report checks what your website and app show the internet from the outside: outdated software, exposed keys and files, forgotten admin pages and missing protections. Every finding is reviewed by a person, with a clear order of what to fix first.
Questions
Node2Shell, answered.
What is Node2Shell (CVE-2026-111497)?
An out-of-bounds write in the Brotli decoder that Node.js bundles, triggered by malformed compressed input. It can crash a Node.js process, leak memory and potentially allow remote code execution. Node.js rates it high, one step below critical. The fix shipped on 21 October 2026.
Which Node.js versions fix it?
Node.js 26.12.1, 24.22.1 and 22.23.4, and any newer patch release on those lines. Node.js 25.x, 23.x, 20.x and older are end of life and get no fix: move to 24 (LTS) or 26. Bun is fixed in 1.4.4.
I don't use Brotli. Am I affected?
Possibly without knowing it. Express 5 and body-parser 2.x decompress Brotli request bodies automatically, and fetch() decompresses Brotli responses automatically. Updating Node.js is the only complete fix.
Why can't the check see my Node.js version?
Node.js never sends its version. Express says only "Express", Next.js "Next.js", Nuxt "Nuxt". So the domain check tells you whether your site runs on Node.js, and the version box tells you, from your own node --version, whether that Node.js has the fix.
My site is a Next.js or Nuxt site. Is it affected?
If a Node.js server renders your pages or runs your API routes, yes, unless that Node.js is updated. A fully static export served from a CDN runs no Node.js at request time, but your build machines still do.
We're on Vercel. Anything to do?
Vercel added firewall rules on 21 October 2026 that block the attack in incoming requests. Requests your app makes to other servers with fetch() are not covered by those rules, so make sure your functions run on a fixed Node.js version.
Is Node2Shell being exploited?
No exploitation in the wild had been reported as of 22 October 2026. A public proof of concept worked only against a deliberately weakened test build, but researchers reported code execution on an unmodified Node.js 24.22.0 image on Linux arm64. Update anyway.
Is there a workaround?
The Node.js advisory lists none. Rejecting Content-Encoding: br requests at a proxy or in middleware reduces inbound exposure only; it does not cover Brotli responses your app fetches.
Is this check safe for my site?
Yes. We request your start page once, exactly like a visitor's browser, and read the server headers and framework markers it sends. We send no compressed data and nothing that tests the flaw. Repeat checks within ten minutes reuse the first result. We keep the domain, the result and a pseudonymised form of your IP address for 90 days to prevent abuse. The version check runs in your browser only.