Node2Shell Checker.
A flaw in the Brotli decoder bundled with Node.js can write out of bounds and lead to remote code execution or a crash. Node.js fixed it in v22.23.4, v24.22.1 and v26.12.1. Paste your Node.js version and get a clear answer in a minute.
Atlas compares the version you type with the Node.js advisory. It never contacts your server, so nothing about your site leaves your side. Run node -v where the app runs, or docker run --rm <image> node -v for a container.
Why Node2Shell Matters.
A Runtime Flaw Reaches Every App On It
Node2Shell (CVE-2026-111497) sits in the Brotli decoder bundled with Node.js, not in one package. A malformed stream can make it write out of bounds, which Node.js says may lead to remote code execution or denial of service. Every app on an unpatched runtime shares the exposure.
Express 5 Reads Brotli By Default
Express 5 apps, and NestJS 11 which runs on them, decompress Content-Encoding: br request bodies in their default body parsers. One crafted request can reach the decoder before any route code runs. Express 4 turns br away with a 415, but still needs the runtime upgrade.
Fixed On 21 October 2026, With Public PoCs
Node.js shipped v22.23.4, v24.22.1 and v26.12.1, and Node.js 20.x and older get no fix. Public proof-of-concept code exists and gives a crash and a limited memory read on standard builds. No in-the-wild exploitation had been reported at time of writing, so the window to upgrade is now.
A Version Check Is A Certain Answer
The version number decides whether a runtime has the fix. Paste it and the answer is firm: vulnerable, or not affected. A tag that moves, like node:lts, gets no verdict until you give the real version.
How The Check Works.
- 01
Get Your Version
Run node -v where the app runs, or docker run --rm <image> node -v for a container. A pinned image tag such as node:22.23.4-alpine works too.
- 02
Paste It In
Add the Express version from npm ls express if you want to know how easily the bug is reached. The Express field never changes the Node.js verdict.
- 03
Read The Verdict
Anything older than 22.23.4, 24.22.1 or 26.12.1 needs the upgrade, and end-of-life lines get no fix at all. A version at or above the fix is not affected.
Why Atlas Checks Your Version Instead Of Scanning Your Server.
Telling a patched server from an unpatched one from the outside would mean sending the malformed data that triggers the bug, and that can crash or corrupt an unpatched server. Atlas never sends exploit traffic to anyone's server. The version number gives a certain answer in one minute, and nothing about your site leaves your side.
FAQ
Common Questions.
Node2Shell is the name Imperva gave to CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js. A malformed Brotli stream can make the decoder write out of bounds. Node.js rates it High and lists the impact as possible remote code execution or denial of service. It was found by OpenAI Codex Security and fixed in the Node.js security release of 21 October 2026.
Node.js v22.23.4, v24.22.1 and v26.12.1, or anything newer on those lines. Node.js 20.x and older are end of life and get no fix, so on those lines that ship Brotli they count as vulnerable: move to a supported line. The same security release fixed nine other CVEs, so upgrading is worthwhile even if you never use Brotli.
Run node -v where the app runs. For a container, run docker run --rm <image> node -v, or read the exact tag in your Dockerfile, such as node:22.23.4-alpine. Paste the result into the checker. A tag like node:24, node:lts or node:latest moves over time, so it cannot be judged from the name alone; run the command and paste the version it prints.
Express 5 apps (body-parser 2.x) with express.json(), urlencoded, raw or text parsers decompress Content-Encoding: br request bodies by default, so one crafted request reaches the decoder before any route code runs. NestJS 11 runs on Express 5 by default. Express 4 rejects br with a 415, so it is not reachable that way, but the runtime still needs the upgrade. Code that calls untrusted servers with fetch(), undici or axios decompresses br responses automatically, and zlib.brotliDecompress on untrusted input reaches the decoder too.
Public proof-of-concept code exists. On standard builds it gives a crash and a limited memory read; full code execution has been shown only on a deliberately weakened build, although Imperva reports code execution in containers. At time of writing (22 October 2026) no in-the-wild exploitation has been reported and the flaw is not in CISA's Known Exploited Vulnerabilities catalog. That can change quickly, so plan the upgrade now.
Telling a patched server from an unpatched one from the outside would mean sending the malformed data that triggers the bug, and that can crash or corrupt an unpatched server. Atlas never sends exploit traffic to anyone's server. The version number gives a certain answer in about a minute, and nothing about your site leaves your side.
No. The verdict comes from the Node.js version alone. The Express field only tells you how easy the bug is to reach: on Express 5 the default JSON parser decompresses Brotli request bodies, so one request is enough; on Express 4 it is not reachable through body parsing, but you should still upgrade because fetch, axios and zlib paths remain.
The fix boundaries are for the official Node.js builds. Some distribution packages use the system Brotli library instead of the one bundled with Node.js, so their exposure follows that distribution's own advisory. When in doubt, check your distribution's security notice for CVE-2026-111497.
Upgrade the Node.js runtime to 22.23.4, 24.22.1 or 26.12.1 or newer: for containers, change the base image to node:22.23.4, node:24.22.1 or node:26.12.1 or newer, rebuild and restart every process. No configuration setting fully removes the risk. As a stop-gap, reject requests that carry Content-Encoding: br at your proxy or WAF, or set inflate: false on body parsers that do not need compressed request bodies.
One Site Checked. See Your Whole Edge.
This tool checks one runtime version. The Brandefense platform inventories every internet-facing system you run, flags new CVEs as they land, and keeps watch over your external attack surface without a break.
Request A Demo