How do I fix Node2Shell?

Upgrade to 22.23.4, 24.22.1 or 26.12.1. On 20.x, 23.x or 25.x there is no release: those branches are end of life. Move to a supported line. Restart every Node.js process. A package update alone does not replace a running binary. If you use a process manager (pm2, systemd, Docker), bounce the service. Verify the version the live server reports, not the one the CLI prints. Container images, nvm, and CI pipelines can drift. Run this check again. If you cannot patch today, put the service behind a reverse proxy that strips or rejects Brotli-encoded request bodies. This slows the known exploit but does not close the bug.

Intelsieve/ check intelsieve.com →

php2shell · oct 2026 node2shell · oct 2026

Is your domain affected by Node2Shell?

Enter a domain. We check every host we find on it and tell you which are still running affected Node.js.

hosts

node

affected

fixed

unknown

host	status	version	evidence	fix

unknown does not mean safe. A host that hides its version could still be vulnerable.

Keep watching

Free weekly rescans of every subdomain we find. Just a work email to start.

Monitor free

What it is

A memory corruption bug in the Brotli decoder

Node.js bundles the Brotli compression library for HTTP content encoding. CVE-2026-111497 is an unchecked return value (CWE-252) in the decoder that causes an out-of-bounds write (CWE-787). A crafted Brotli-compressed payload delivered over HTTP triggers the write before any application code runs.

Any Node.js server that accepts compressed request bodies or fetches compressed content from an untrusted source is in scope. Express, Fastify, Koa, Hapi, NestJS, Next.js: the framework does not matter because the bug is in the runtime, not the framework.

Express

Fastify

KoaHapi

NestJS

Next.js

Remix

Nuxt

SvelteKitanything on Node.js

Timeline

Days from advisory to exploitation

21 Oct 2026Node.js publishes fixed releases for 22.x, 24.x and 26.x. The advisory rates the flaw as high severity.

22 Oct 2026Imperva publishes a working proof of concept, confirmed on the official Node.js 24.22.0 arm64 image.

23 Oct 2026Multiple public PoCs circulate. Not yet in CISA's Known Exploited Vulnerabilities catalog.

What to do

Upgrade the runtime, restart the processes, verify from outside

Upgrade to 22.23.4, 24.22.1 or 26.12.1. On 20.x, 23.x or 25.x there is no release: those branches are end of life. Move to a supported line.
Restart every Node.js process. A package update alone does not replace a running binary. If you use a process manager (pm2, systemd, Docker), bounce the service.
Verify the version the live server reports, not the one the CLI prints. Container images, nvm, and CI pipelines can drift. Run this check again.
If you cannot patch today, put the service behind a reverse proxy that strips or rejects Brotli-encoded request bodies. This slows the known exploit but does not close the bug.

How this check works

What we send and what we don't

We look up hostnames for your domain, check what Node.js version each one reports in its HTTP headers, and flag the ones running affected builds. No exploit code, no request body, no Brotli payload.

There are limits to what a passive check can tell. Node.js servers rarely expose their version in headers: Express does not include it by default, and most production setups strip or hide the Server header. A host that hides its version reads as unknown. A host behind a CDN or load balancer that masks the origin server may show as 'not node' even when Node.js is running behind it. Both need a look from inside. Results are kept for 24 hours so a repeat check is free, and are not indexed.

References

Upstream is the source of truth

Node.js October 2026 security releases Imperva: Node2Shell PoC analysis Aikido: Node2Shell explained Brandefense: fixed versions Indusface: CVE-2026-111497 analysis

The vulnerability was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer.