Skip to content
Is our app affected by Node2Shell? What to ask your developer
Back to Blog
#Node2Shell#CVE-2026-111497#Node.js Brotli vulnerability#Node.js security update#.NET Brotli patch#Node.js 20 end of life

Is our app affected by Node2Shell? What to ask your developer

Sadaf Masood

If your web app, API or customer portal runs on Node.js, treat it as affected by Node2Shell (CVE-2026-111497) until your developer shows you the version number. The fix is a routine runtime update to Node.js 22.23.4, 24.22.1 or 26.12.1, or anything newer, everywhere the app runs. If the app is still on Node.js 18 or 20, there is no fix to install, and the job becomes an upgrade you need to approve now.

Apps built on .NET need Microsoft's 25 October update: 8.0.33, 9.0.22 or 10.0.14. Node.js has also announced another security release for 11 November, so book your developer for two updates, not one.

How serious is it?

Serious enough to act this week. The flaw is in Brotli, the compression format that browsers and servers use to shrink web traffic. A crafted compressed message can crash the app, leak parts of its memory or, in the worst case, let an attacker run their own code on your server.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalogue of exploited vulnerabilities on 27 October and gave US federal agencies until 10 November to fix it. That deadline binds only those agencies, but the listing means CISA has evidence of real attacks. Help Net Security reports exploit traffic coming from an address already seen scanning for other web flaws in bulk, which points to attackers trying every server they can reach, not picking targets.

Is our app actually exposed?

It is exposed if it unpacks Brotli data that someone outside your business controls. Three cases cover most Node.js apps:

  • It accepts compressed requests. Express 5 and body-parser 2.x, two common Node.js building blocks, unpack request bodies sent as Brotli, so any visitor can send one. A plain Node.js server without them does not.
  • It fetches from other servers. Node's built-in fetch() unpacks Brotli responses automatically. Webhooks, link previews and any feature that calls a web address a user typed in are the usual way in.
  • It runs from a pinned container image. An image built on, say, Node.js 24.22.0 stays vulnerable however often it restarts. It has to be rebuilt on a fixed version and redeployed.

.NET is less exposed by default. Microsoft says an app is affected only if it uses ASP.NET Core request decompression, HttpClient's automatic response decompression or the Brotli APIs directly:

"Brotli decompression is not enabled by default in an out-of-the-box .NET or ASP.NET Core install." Microsoft, as quoted by BleepingComputer

Update anyway, on either platform. The fix is a version change, and the next feature someone adds could open the door that is closed today.

What should I send my developer?

Ask for written answers for every app and every environment, including staging and test servers:

  1. Which Node.js or .NET version is running in production, and is it at or above the fixed versions?
  2. Have the container images been rebuilt and redeployed, and does each running service now report the new version?
  3. Is any app still on Node.js 18 or 20? If so, what will the move to a supported version take, and by when?
  4. Who will apply the 11 November Node.js release, and by what date?

A good answer is a version number for each service, read from the running system. "We always use the latest" is not an answer. Aikido Security's write-up gives your developer the exact commands to check versions on servers and inside containers.

What will it cost?

On a supported version, very little. It is the same work as any routine update: change the version, rebuild, test, redeploy.

On Node.js 18 or 20, it is a different decision. Node.js 20 reached end of life on 30 April 2026 and Node.js 18 a year earlier, so neither gets a fix for this flaw or the next one. You can upgrade to a supported version, which means testing the app and its libraries on the new runtime, or pay a third-party vendor for extended support and keep running the old one.

If you upgrade, choose the target with care. Node.js 22 reaches end of life on 30 April 2027, less than six months away. Moving to 24 (supported until April 2028) or 26 (until April 2029) now saves you a second upgrade next year.

If the same app also runs on .NET 8 or 9, both lose Microsoft's security fixes on 10 November. Our guide to the .NET 8 deadline covers that move.

Next step: if you have no developer on call, or the answers come back vague, send Vesprr Software a list of the apps you run. We will check the versions with you and quote the update or upgrade.

Sources