Blog · 2026-10-23 · Gardience Engineering

Node2Shell CVE-2026-111497: check and patch Node.js Brotli

CVE-2026-111497 is in Node.js and in the system Brotli library, on Linux and Windows. How to find every affected server and patch it, with the commands to check your own. Patched on Windows in 22 seconds.

When the Node.js security release came out on October 21, we figured it was a Node problem. Update Node, move on. Then we actually read the CVE.

CVE-2026-111497 (people are calling it Node2Shell) is an out-of-bounds write in the Brotli decoder. Node.js bundles Brotli, which is why every supported Node line got a fix: 22.23.4, 24.22.1 and 26.12.1. But Brotli doesn't only live inside Node. Lots of Linux packages use the system Brotli library, and Red Hat lists Firefox and Thunderbird as affected too. You're exposed if something on the box decompresses Brotli data an attacker controls. There's no workaround. You update.

So we went and looked at our own lab.

What it caught on Linux before we asked#

We run Gardience against a lab of Linux and Windows machines. It checks every machine once a day against each vendor's own security data. Thursday morning we typed the CVE into the lookup, and it had already found it on seven Debian machines:

None of those seven run Node.js. Every one got flagged for libbrotli1, the system library. If our only question had been "where do we run Node?" we'd have missed all of them. They say "exposed, no fix published yet" because Debian hasn't shipped a fixed package. When it does, that same page gives us a button that installs just that fix on just those machines.

Two machines say "not exposed," and we don't want to oversell that. The Ubuntu box is clean only because Canonical still has the CVE marked "needs evaluation." The Rocky 9 box is clean because Red Hat lists brotli as affected on RHEL 8, 9 and 10 but hasn't released a fix yet, and our RHEL check reads the advisories a machine can actually install. Both will flip when those vendors publish. Until then we're watching their pages like everybody else.

Windows is where this gets missed#

This is the part we care about most. Node.js on Windows doesn't come through Windows Update, and Microsoft's security data doesn't cover it. Your patch report can say a server is fully patched while it's running a vulnerable Node.

We wanted to see it for ourselves, so we installed the vulnerable Node.js 24.22.0 on a Windows 11 machine in the lab. Then we ran the "List Windows app updates" runbook across our Windows group. It asks each machine which apps have a newer version in Microsoft's winget catalog:

There it is. Node.js 24.22.0 -> 24.22.1. It also caught an Edge update we hadn't gotten around to.

Next we ran "Update Windows apps" and gave it one package id, OpenJS.NodeJS.LTS, so nothing else on the machine would change:

It took 22 seconds. We checked the machine directly afterward and node --version came back v24.22.1.

One machine is a small test, we know. What matters is it works the same way across a few hundred Windows servers, it waits for approval if your policy says it should, and every machine's result lands in the audit log. One heads up: winget ships with Windows 10, Windows 11 and Windows Server 2025. On Server 2019 and 2022 you'll need to install Microsoft's App Installer first.

Checking one server by hand#

If you've only got a box or two, this is what we'd run.

On Linux, find every copy of Node and its version, plus the Brotli library:

which -a node nodejs 2>/dev/null | xargs -r -I{} sh -c 'echo "{}: $({} --version)"'
ls ~/.nvm/versions/node 2>/dev/null
dpkg -l 'nodejs' 'libbrotli*' 2>/dev/null | grep ^ii      # Debian and Ubuntu
rpm -q nodejs brotli 2>/dev/null                          # RHEL, Rocky, AlmaLinux

Anything under 22.23.4, 24.22.1 or 26.12.1 needs updating. How depends on where it came from:

sudo apt-get update && sudo apt-get install --only-upgrade nodejs libbrotli1   # distro or NodeSource packages
sudo dnf upgrade nodejs brotli                                                # RHEL family, once the fix ships
nvm install 24.22.1 && nvm alias default 24.22.1                               # nvm

Restart your Node services afterward. A running process keeps the old code until it restarts. For containers, rebuild on a fixed Node base image and redeploy.

On Windows:

where.exe /r C:\ node.exe
winget list --id OpenJS.NodeJS
winget upgrade --id OpenJS.NodeJS.LTS --silent --accept-package-agreements --accept-source-agreements
node --version

Use OpenJS.NodeJS instead if you're on the Current line. If someone installed Node with the installer from nodejs.org and winget doesn't list it, run the fixed installer over the top. Then restart whatever runs Node, like a Windows service or an IIS app pool.

Where the vendors are (October 23)#

This is moving fast, so check those pages again before you plan anything around them.

What our check won't catch#

We'd rather say this up front. A check based on installed packages, ours included, doesn't see:

• Node installed with nvm or unpacked from a tarball. Running node --version on every server at once will find them. In Gardience that's the "Run a command" runbook. It's off by default and only root on the Gardience server can turn it on, so someone with a stolen console login can't start running commands on your fleet.
• Node inside container images. Scan the images and rebuild them.
• Apps that ship their own copy of Node or Brotli. Those come from their vendor.

Quick answers#

Which Node.js versions fix CVE-2026-111497?#

22.23.4, 24.22.1 and 26.12.1, all released October 21, 2026. Lines that are already past end of life don't get a fix, so move to a supported one.

I don't run Node.js. Am I safe?#

Maybe not. The bug is in Brotli, and a lot of Linux software uses the system Brotli library. Red Hat also lists Firefox and Thunderbird. Check your distro's page for the brotli package.

Does Windows Update patch Node.js?#

No. Node is a separate app. Update it with winget or the nodejs.org installer, then restart what runs it.

Is anyone exploiting it yet?#

As of October 23 it isn't in CISA's Known Exploited Vulnerabilities catalog, and reports on how practical the public proof of concept is don't agree. We'd patch anyway. There's no workaround.

How do I find every exposed server at once?#

Check every machine's packages against your vendors' security data every day, and ask every Windows machine which apps are out of date. That's what we used Gardience for here: the CVE lookup for Linux, "List Windows app updates" for Windows, then one approved run to fix them.