How to fix Node2Shell (CVE-2026-111497) in Node.js

Your app is exposed if a Node.js process of yours decompresses Brotli data that someone else controls. The common ways that happens:

• Your server accepts request bodies sent with Content-Encoding: br. Express 5 with body-parser 2.x decodes them automatically.
• Your code calls fetch() on URLs you don’t control, such as webhooks, link previews or URLs a user types, and the response comes back Brotli-compressed.
• Your code passes untrusted data to zlib.brotliDecompress(), brotliDecompressSync() or createBrotliDecompress(), directly or through a library.

The bug runs on the server, not in your visitors’ browsers. A Lovable or Bolt app whose only backend is Supabase runs no Node.js server of yours, and Supabase Edge Functions run on Deno, so check Supabase’s own notices for those. If you run Bun, check its release notes for this CVE.

Run this where your app actually runs: each server, container and CI runner, not only your laptop.

node --version
docker run --rm your-image node --version

In your project, look for the version pinned in .nvmrc, the engines field of package.json, your Dockerfile and your CI workflow (actions/setup-node).

1. Install 22.23.4, 24.22.1 or 26.12.1, or any newer release in the same line, on every server, container and CI runner.
2. In a Dockerfile, pin a fixed version, rebuild the image and redeploy. A tag like node:24 only picks up the fix when the image is rebuilt.
3. Restart every Node.js process. A running process keeps the old version until it restarts.
4. Run node --version again on the running server to confirm.

FROM node:24.22.1-slim

On Vercel, functions on Node.js 22.x or 24.x get the patched version from Vercel, with no change on your side; Vercel was still rolling it out on 22 October. Vercel also added firewall rules on 21 October that block the attack in incoming requests, but they don’t cover responses your functions fetch from other servers. Projects still on Node.js 20.x need to move to 22.x or 24.x in the project settings.

On other hosts, check the status page or changelog for the Node.js version their runtime uses, and redeploy once it is patched. If you run your own server or container, the update is yours to do.

These reduce the risk for a few days, but none of them replaces the update:

• Reject requests with Content-Encoding: br at your proxy, load balancer or firewall.
• In Express, set inflate: false in the body parser options, so compressed request bodies are refused instead of decoded.
• Pause features that fetch URLs you don’t control, such as link previews or user-supplied webhooks. A malicious server can send a Brotli response whatever your request asks for.

app.use(express.json({ inflate: false }));
app.use(express.urlencoded({ extended: false, inflate: false }));

Only a check that sees the Node.js version your app runs on, such as a scan of your servers or container images, or simply node --version. A scan of your website from the outside can’t see it, and neither can a scan of your dependencies, because Node.js itself isn’t a package in your lockfile.

Afterprompt doesn’t detect Node2Shell. While you patch, our free scan checks what anyone can see from the outside, like API keys in your JavaScript and files left public, and our code scan checks the npm packages in your lockfile for known vulnerabilities on every push, for free. On Pro, those packages are also checked every week against newly published vulnerabilities, with an email when one affects you.

• Node.js security releases, 21 October 2026
• Vercel security bulletin for CVE-2026-111497