Node2Shell: Is Your Website Affected? What to Do

Node2Shell is the name given to CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js, fixed on 21 October 2026. The fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older are end of life and get no fix. If you are unsure whether your website or app runs on Node.js, or which version, ask your web company or host now.

This article explains what Node2Shell is in plain terms, which sites it affects (including Next.js websites), which versions fix it, why Node.js 20 being end of life is a problem of its own, and what to ask your web company or host if you are not sure you are covered.

What Node2Shell Is, in Plain Terms

Brotli is a compression format, used to make web pages and data smaller as they travel between servers and browsers. Node.js includes its own Brotli decoder. The Node.js security advisory describes a flaw in that decoder: malformed compressed data can make it write past the end of an internal buffer.

In the advisory's words, an attacker who can supply Brotli data that an application decompresses "can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution". Node.js rates this vulnerability High. The flaw is in Node.js itself, not in your website's code or the packages it uses.

Is Your Website Affected by Node2Shell?

First, does your site run on Node.js on the server? Many modern websites and web apps do, including those built with Next.js, Nuxt, Remix or Express, and many custom web apps and APIs. Most WordPress sites do not: WordPress runs on PHP, so Node2Shell does not affect it. (PHP had its own serious flaw the same week; our PHP2Shell guide covers that one.)

If it does run on Node.js, it is affected if it runs a version below the fixed releases: on the 22 line below 22.23.4, on 24 below 24.22.1, or on 26 below 26.12.1. Node.js 20 and older have no fix at all.

How exposed a particular site is depends on whether it decompresses Brotli data an attacker could influence, for example a server reading a compressed response from another service, or accepting compressed uploads. That is a question for whoever built it. Because the flaw can lead to remote code execution, the safe answer is the same either way: update.

Is My Next.js Website Affected?

A Next.js website runs on Node.js on the server, so it is affected if that server runs an unpatched Node.js version. This is a Node.js vulnerability, not a Next.js one: updating Next.js itself does not fix it. The Node.js version underneath has to move to 22.23.4, 24.22.1 or 26.12.1.

If your Next.js site runs on a hosting platform that manages Node.js for you, check that the platform has moved to a fixed version. If it runs in its own server or container, the Node.js version is set in its build, and whoever maintains the site needs to update it and redeploy.

Which Node.js Versions Fix Node2Shell

The Node.js advisory lists three fixed releases. The table shows each line, the version that fixes it, and when security support ends, taken from the Node.js release schedule.

Node.js 22 is fixed, but its support ends in April 2027. A site that moves to 22.23.4 now still needs a planned move to 24 or newer during next year.

Node 20 End of Life: What If Your Site Is on Node.js 20 or Older?

Node.js 20 reached end of life on 30 April 2026. The Node.js project is clear that end-of-life versions are always affected when a security release comes out, and they get no update. A site on Node.js 20, 19, 18 or older stays exposed to Node2Shell until it moves to a supported version.

Moving up a major version can break dependencies or build steps written for the older one, so it should be tested on a staging copy before going live. For most modern sites it is a routine job, but it does need doing.

The Other Fixes in the Same Release

The same Node.js security release fixes nine other vulnerabilities, three of them also rated High: two that let a TLS certificate check be bypassed with unusually written IP addresses, and one where DNS lookups mishandle names containing a hidden null character. Updating for Node2Shell fixes all of them at once.

Is Node2Shell Being Exploited?

As at 23 October 2026, there were no confirmed attacks. Security researchers have published proof-of-concept code, which usually shortens the time before attacks start. The Node.js advisory itself makes no statement about attacks in the wild.

The advice doesn't depend on how that develops. The flaw is public, fixed versions exist, and an unpatched server is exposed for as long as it stays unpatched.

What to Ask Your Web Company or Host

If someone else manages your site or app, these questions get to what matters:

• Does my website or app run on Node.js on the server?

• If so, which Node.js version is running in production?

• Has it been updated since the Node.js security release of 21 October 2026?

• If it is on Node.js 20 or older, what is the plan and timeline to move it?

A useful answer gives you a version number and a clear next step. If your site was built some time ago and nobody has touched the server since, it is worth asking even if you think it is fine.

If Your Site Was Unpatched: Check for Signs of a Hack

If your site ran an affected version and has only just been updated, it is worth checking that nothing changed while it was exposed: unexpected files, new admin accounts, or pages you did not create.

Our guide to signs your website has been hacked covers what to look for. If you find something you cannot explain, our hacked website recovery service covers sites built on PHP, Node.js or JavaScript, and generally costs around £300 depending on whether usable backups are available. That service is for sites not on our platform.

Keeping Node.js Up to Date Without Chasing It

Node2Shell landed the same week as PHP2Shell. Flaws like these will keep coming, and each one means updating the server software, not just the website. For most small businesses, the practical answer is a managed website where that is handled for you.

We have updated every website on our platform to a fixed Node.js version, and there is nothing our clients need to do. Security patches and updates are part of every plan, along with backups, and if a site on our platform is compromised, putting it right is included. Our managed websites page sets out what each plan covers.

Node2Shell FAQs

If you want hosting where security patches and updates are handled for you, our managed websites plans set out what is included. Or get in touch to talk through what your site runs on and what needs to happen next.