Skip to content
IT-Checklist

Node2Shell: the Node.js flaw, which version you need and what to do

Last updated on

Read the in-depth version

On Wednesday 21 October 2026 nearly all attention went to the PHP flaws that took DigiD and other Dutch sites offline. The same day Node.js released a security update too, for ten vulnerabilities at once. One of them, now known as Node2Shell, lets an attacker run their own code on your server. On 23 October the Dutch National Cyber Security Centre (NCSC) urged everyone to update right away (NCSC, in Dutch (opens in new tab)).

What is Node.js and do you run it?

Node.js is the software that runs JavaScript on a server. Many modern websites and web apps use it, for example sites built with Next.js. Self-hosted tools such as the automation tool n8n run on Node.js too. Do you have a simple WordPress site? That runs on PHP, so this flaw most likely does not affect it. In doubt? Ask your web developer or IT partner.

What is going on

The flaw is in Brotli, a piece of software from Google that compresses and decompresses files. Web servers use it to make pages smaller before sending them to the browser (Security.NL, in Dutch (opens in new tab)). Node.js ships its own copy of Brotli. If an attacker sends specially crafted compressed data, Node.js writes outside the piece of memory meant for it. That lets the attacker crash the system, read data from memory or run their own code. No login needed (NCSC (opens in new tab)).

Node.js rates the flaw high. Google, which registered the CVE, gave it a CVSS score of 9.2 and calls it critical (Convika (opens in new tab)). The Belgian Centre for Cybersecurity also uses 9.2 (CCB (opens in new tab)).

Overview: safe versions and release date

The update came out on Wednesday 21 October 2026, at around 10:38 UTC (Convika (opens in new tab)). These versions contain the fix (Node.js (opens in new tab)):

  • Node.js 26: update to 26.12.1 or later (the latest release).

  • Node.js 24: update to 24.22.1 or later (the current LTS version, the right choice for most businesses).

  • Node.js 22: update to 22.23.4 or later.

  • Node.js 25, 23, 20 and older: no update. These versions are no longer supported and stay vulnerable. Move to 24 or 26 (Aikido (opens in new tab)).

  • Bun (an alternative to Node.js): update to 1.4.4 or later (Aikido (opens in new tab)).

Why updating your packages is not enough

The flaw is in Node.js itself. Updating your npm packages, such as Express, does not change the Node.js version (Aikido (opens in new tab)). That has to go up on the server, in your Docker image or at your hosting provider. A Docker image pinned to an old version, such as node:24.22.0, stays vulnerable until you rebuild it (Convika (opens in new tab)).

What to do now

  1. Find out where Node.js runs. Think of your website or web app, self-hosted tools and your developer's servers. Ask your web developer or IT partner if you do not know.

  2. Check the version. On the server, type node --version. If the number is lower than in the overview above, you need to update.

  3. Running 20, 23 or 25? Plan the move. Test first whether your application works on version 24 or 26.

  4. Do not forget the rest. Rebuild Docker images and also update the build servers that build your code.

  5. Keep an eye on it. On 23 October no exploitation was known yet (NCSC, in Dutch (opens in new tab)). Example code showing how the attack works has already appeared, so do not wait too long (Aikido (opens in new tab)).

Two big flaws on one day show that you need to know which software sits under your website. Put in your emergency plan who manages your website, what software it runs on and who installs the updates.

Download and print the cyber attack emergency plan

A checklist of a few pages that you fill in once and then print. With the first steps, a list of contacts and the reporting deadlines.

Go to the cyber attack emergency plan

Want to know where you stand? Take the free IT check and see the suppliers and cloud checklist for what to agree on updates with your hosting provider and web developer.

In depth: the details

For readers who want more: technical details, the damage and the sources.

All ten flaws

The update of 21 October fixes ten flaws. Four are rated high, three medium and three low. Most affect all three supported versions (Node.js (opens in new tab)).

High

  • CVE-2026-111497: Node2Shell. Brotli writes outside its memory, which allows remote code execution. Affects 22, 24 and 26.

  • CVE-2026-105482: dns.resolve*() and dns.reverse() cut off names at a NUL character. Affects 22, 24 and 26.

  • CVE-2026-105483: the TLS hostname check can be bypassed with an IP address written in fullwidth digits. Affects 24 and 26.

  • CVE-2026-106069: the TLS hostname check can be bypassed with an IPv4 address with leading zeros. Affects 22, 24 and 26.

Medium

  • CVE-2026-105481: a keep-alive connection accepts a response that arrives before the request was sent.

  • CVE-2026-106072: IPv4 hostnames written in a non-standard way let a certificate for a domain name also count for an IP address.

  • CVE-2026-106074: randomUUID() and randomInt() can return the same values in different processes when their cache is saved in a snapshot or SEA.

Low

  • CVE-2026-106070: zlib.ZipFile returns attacker data after a failed header check. Only 26.

  • CVE-2026-106071: a wildcard in the Permission Model grants more file access than intended. Only 26.

  • CVE-2026-106073: the Permission Model can be bypassed through fs.realpathSync(). Affects 22, 24 and 26.

c-ares, Undici and the list of trusted certificates were updated too, because an intermediate certificate from eMudhra was compromised. Versions 22 and 24 also got a new OpenSSL, and version 22 a new SQLite (Node.js (opens in new tab)).

How Node2Shell works

The attack arrives through compressed Brotli data. According to Aikido and Cyber Kendra there are two ways in (Aikido (opens in new tab), Cyber Kendra (opens in new tab)).

  • Your application uses the built-in fetch() to get something from someone else's server. fetch() decompresses Brotli responses on its own, so a malicious server can send the attack back. Think of webhooks or addresses that a user fills in.

  • Your server accepts requests with Content-Encoding: br and decompresses them. Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 do this automatically.

A bare Node.js web server without such middleware does not decompress incoming Brotli data (Cyber Kendra (opens in new tab)). You still need the update, because the route through fetch() stays open.

Temporary measure

Node.js lists no workaround itself. You can reject requests with Content-Encoding: br at a reverse proxy or load balancer. That only helps against attacks on your server. Responses your application fetches with fetch() remain a risk, so updating is the real fix (Aikido (opens in new tab)).

Beyond Node.js

The flaw is in Google's Brotli library, versions 1.0.3 to 1.2.0. The fix is in Brotli 1.0.10, 1.1.1 and 1.2.1. The Python Brotli package is fixed in 1.2.1 and Bun in 1.4.4 (Cyber Kendra (opens in new tab)). Debian's Node.js packages use the system's Brotli, so there the brotli package needs updating. On 23 October Debian had no fixed version for it yet (Convika (opens in new tab)).

Was the flaw already being exploited?

The Dutch NCSC rates the chance of exploitation as medium and the possible damage as high. There was no evidence of exploitation on 23 October (NCSC, in Dutch (opens in new tab)). The US CISA had not added it to its list of exploited vulnerabilities by then either (Cyber Kendra (opens in new tab)). Security firm Imperva did show on 22 October that the attack works. It ran its own code on the official Docker image of Node.js 24.22.0, although that took several attempts. Version 24.22.1 stopped the same attack (Cyber Kendra (opens in new tab)).

Timeline

According to the Node.js advisory, Matteo Collina reported the issue and Antoine du Hamel wrote the fix (Cyber Kendra (opens in new tab)).

Sources