Fix guides / Security notices

Security notice

Does your site or checkout run on Node.js? Researchers just showed a takeover. Update today.

Last updated: Sunday, October 25, 2026, 12:28 AM ETStatus: Fix released. Researchers showed code execution in a test. No attacks reported yet.

On October 21, 2026, Node.js fixed CVE-2026-111497, a flaw it rates High. Node.js is the software that runs many modern websites, online stores, checkouts and APIs, including many built with Next.js or Express. Node.js says a bug in its built in Brotli decoder, the part that unpacks compressed data, "permits remote code execution." A day later, Imperva's red team showed attacker supplied code running on an unpatched Node.js server in its own tests. Every supported line, 22.x, 24.x and 26.x, is affected, and Node.js 20 and older will not get a fix. If your site, store or checkout runs on Node.js, ask your developer today whether it is updated.

Update, October 24, 2026

The same bug sits in other software that carries its own copy of Google's Brotli library. Bun, Envoy and some Linux distributions have now shipped fixes. If your site runs on Bun, sits behind an Envoy proxy, or runs on a Linux server, update those too, not just Node.js.

  • It is a Brotli library bug. The CVE record says the flaw is in the decoder of Google's Brotli library, versions 1.0.3 through 1.2.0, and is fixed in 1.0.10, 1.1.1 and 1.2.1. It says a crafted compressed stream could crash a program, leak memory contents or potentially run attacker code. Every program that bundles its own copy has to ship its own fix. (CVE record via OSV)
  • Bun. On October 23, Bun said versions 1.0.21 up to 1.4.3 carry an affected Brotli and that Bun 1.4.4 fixes it by moving to Brotli 1.2.1. Bun's built in fetch asks for Brotli and unpacks it automatically, so a server your app connects to could send the bad data, as could someone in the middle of an unencrypted connection. Programs built with bun build --compile stay affected until they are rebuilt with 1.4.4. Bun says it has not tested an attack against Bun but to treat this as a remote code execution risk. There is no global workaround; passing decompress: false to fetch protects only that one request. (Bun)
  • Envoy. On October 23, the Envoy proxy project rated its version of the bug critical, 9.2 out of 10. It names Envoy 1.39.2, 1.38.5, 1.37.7 and 1.36.11 as vulnerable and fixes them in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12. Envoy says only setups with its Brotli decompressor configured are affected. (Envoy)
  • Linux server packages. Debian fixed its brotli package on October 23 for Debian 12 (version 1.0.9-2+deb12u1) and Debian 13 (1.1.0-2+deb13u1). Alpine lists fixed brotli packages for Alpine 3.21, 3.23 and 3.24. As of October 24, Ubuntu lists its brotli packages as "Needs evaluation", so there is no Ubuntu fix to install yet. Distributions often fix older version numbers in place, so check for your distribution's security update rather than for Brotli 1.2.1. Debian notes that its own Node.js package uses the system Brotli library. (Debian, Alpine via OSV, Ubuntu)
  • Still no attacks reported. None of these advisories reports attacks, and the flaw was not on CISA's list of known exploited flaws in the latest version we checked, dated October 23, 2026. (CISA KEV)

What to do

Ask your developer, agency or host three things: is any app on Bun, and is it on 1.4.4 or later with every compiled Bun program rebuilt? Does anything run Envoy with Brotli decompression, and is it on a fixed release? Have the Linux servers had their brotli security update, where one exists? The Node.js advice below is unchanged. EverThread does not test for this flaw. Our scans check your site from the outside and cannot see which Bun, Envoy, Node.js or Brotli version your servers run. (Bun, Envoy, Debian)

What happened

Who should worry

Ask about this if any of these are true:

If your site runs entirely on a hosted builder such as Shopify, Squarespace or Wix, the platform runs its own servers. This matters to you only if a developer built you separate Node.js code, such as a custom app or checkout add on.

What to do now

Do these today.

  1. Ask the question. Send the message below to your developer, agency or host. You need a clear answer: do we run Node.js anywhere, and is every copy on 22.23.4, 24.22.1 or 26.12.1 or later?
  2. Update every Node.js runtime. Include servers, container images, self hosted Next.js, build servers and test copies. Vercel says this applies even if you are behind a firewall. (Vercel)
  3. On Vercel? Vercel says it manages patch versions for projects on Node.js 22.x and 24.x. Projects on 20.x must switch to 22.x or 24.x and redeploy. (Vercel)
  4. On Node.js 20 or older, there is no fix. Move to a supported version now. (Vercel, Node.js)
  5. If the answer is "I don't know", that is not a no. Ask them to check using the steps below.

What to send your developer, agency or host

Node.js released security updates on October 21, 2026, including CVE-2026-111497, a high severity out of bounds write in the built in Brotli decoder that Node.js says permits remote code execution. Imperva reported on October 22 that it achieved code execution in its own tests through fetch() and through Express 5 and body parser 2 request parsing. Please confirm every place Node.js runs for our business, including servers, container images, self hosted Next.js, build servers and test copies, and update each one today to 22.23.4, 24.22.1 or 26.12.1 or later. Anything on Node.js 20 or older needs to move to a supported version, because it will not get this fix. Sources: Node.js, Vercel, Imperva.

Technical steps

Step 1. Check every runtime

node -v

Run it on each host and inside each running container. Imperva warns that a package inventory can miss an older Node.js bundled inside a container image. (Imperva)

Step 2. Update

Install 22.23.4, 24.22.1 or 26.12.1 or later for your line. For containers, rebuild on a patched Node.js base image and redeploy. For self hosted Next.js, update Node.js itself. (Node.js, Vercel)

Step 3. Find where outside Brotli data comes in

Check incoming requests whose bodies are unpacked by middleware such as Express 5 or body parser 2, and responses your code fetches from other servers with fetch(). Only the runtime update covers fetched responses. (Imperva, Vercel)

Step 4. Until you can update

Where practical, temporarily limit untrusted Brotli traffic, for example requests sent with Content-Encoding: br, on affected paths, and test against your normal traffic first. Imperva notes unexpected crashes during decompression may help you decide where to look, but are not proof of an attack. (Imperva)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. None of the sources we checked report attacks using this flaw as of October 24, 2026. Imperva's code execution result came from its own test setup. With researchers already showing it working, update now rather than wait.

Can EverThread tell me if I am affected?

No. EverThread checks websites from the outside, the way a browser sees them. We cannot see which Node.js version your server runs or whether your app unpacks Brotli data, and we do not test for this flaw. Your developer or host can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Why is it called Node2Shell?

That is the name Imperva's red team gave its analysis. The Node.js project calls it CVE-2026-111497. (Imperva, Node.js)

We are behind a web firewall. Do we still need to update?

Yes. Vercel says its firewall does not cover responses your code fetches from other servers and does not replace patching. (Vercel)

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check servers for the Node.js flaw above. No account.

Or sign up free and we check it every day and email you when something changes.