A remote-code-execution flaw in Node.js's built-in Brotli decoder — CVE-2026-111497 — patched 20–21 October 2026 across Node 22, 24 and 26. Check your version below, then upgrade.
Node never advertises its version over the network, so this is the reliable check: run node -v on your server and enter it. Runs in your browser — nothing is sent.
Guidance reflects the Node.js releases of 20–21 Oct 2026. A version check is not a guarantee — when in doubt, upgrade.
Treat any pre-patch release on a supported line as affected.
| Node line | Affected | Patched release |
|---|---|---|
| Node 26.x | below 26.12.1 | 26.12.1 |
| Node 24.x | below 24.22.1 | 24.22.1 |
| Node 22.x | below 22.23.4 | 22.23.4 |
| Node 20.x and earlier | end-of-life — unpatched | upgrade line |
Move to the patched release for your line (22.23.4, 24.22.1 or 26.12.1, or newer) and rebuild any container images or bundled binaries that pin an older Node. There is no in-runtime workaround — upgrading is the only thing that closes it.
If you cannot upgrade immediately, limiting untrusted Brotli-compressed traffic on affected paths reduces exposure — but the advisory lists no real workaround inside Node, so treat this as buying time, not a fix, and upgrade as soon as you can.
Context from disclosure: the flaw is in Node's built-in Brotli decoder — a crafted stream hits an impossible block-type change and keeps processing in an invalid state, reaching an out-of-bounds write. A working proof-of-concept has run on official Node builds, which is reason to patch rather than wait.
XIBA doesn’t scan your Node apps — it watches Microsoft 365 for account takeover, business-email-compromise and lookalike-domain attacks. But the gap Node2Shell exposes is the one XIBA closes directly: its threat-intelligence feed surfaces critical CVEs and exploited-in-the-wild alerts and routes them to your team — Teams, Slack or email — the moment they land. If a tweet three days late is how your team would have found out, that delay is the problem worth fixing.