Skip to main content
On 21 October 2026 Node.js released fixes for Node2Shell, CVE-2026-111497: an out-of-bounds write in the Brotli decoder bundled with Node.js. An attacker who can get an application to decompress malformed Brotli data can crash it and potentially run code on the server. Node.js rates it high severity. Every supported Node.js release line was affected. Your vulnerability scanner is the best way to find vulnerable Node.js. ThreatAware helps most by showing the servers and workstations that scanner isn’t covering, where a vulnerable Node.js install could go unnoticed.

​
Are you affected?

Bun is also affected: upgrade to 1.4.4 or newer. Linux distribution Node.js packages may use the system Brotli library instead, so check your distribution’s advisory too. An application is exposed when it decompresses Brotli data an attacker controls. The common cases:
  • Servers that decode request bodies sent with Content-Encoding: br, such as Express 5 and body-parser 2.x. A bare Node.js HTTP server doesn’t do this on its own.
  • Outbound calls with fetch(), which decompresses Brotli responses automatically. Webhooks and features that call user-supplied URLs are the typical targets.
  • Direct use of the node:zlib Brotli functions on untrusted input.
Then check your scanner for findings on CVE-2026-111497:
  • A finding: vulnerable.
  • Recent credentialed scan, no finding: likely fixed.
  • No recent credentialed scan: unknown. Treat it as vulnerable until it’s scanned.
A scan from before 21 October 2026 can’t confirm the fix.

​
What ThreatAware can do on your plan

​
Find affected devices

​
1. Find the gaps in your scanner’s coverage

This works exactly as for PHP2Shell: use the integration columns in Devices on Connect, and Vitals on Discover. For example, with Microsoft Defender as your scanner: Swap in your scanner: type system. in the query bar and autocomplete lists your integrations.

​
2. Spot likely Node.js installs with software inventory

Treat it as a guide, not a vulnerability check. A software query only matches where a connected tool lists Node.js as installed software, so many installs never appear (see Blind spots). Software data refreshes about every two days. The query bar is case sensitive, so try Node.js, node and nodejs.
Node.js on a device with no working scanner is where a vulnerable install is most likely to go unnoticed:
To list Node.js installs that aren’t on a fixed release:
On Linux, run it again with nodejs* in place of Node.js*. If a later patch release comes out in the same line, add it to the query. As with PHP, Linux distribution packages can carry a fix without changing the version number.

​
Track the fix

  1. Run a query from step 1 or step 2 and click Track View. Choose Snapshot and set a Deadline. See Tracked Views.
  2. In Action Center, build a flow triggered by that tracked view to email the device owners or open tickets.
  3. Save the query as a view and send a daily Scheduled Report of it until it’s empty.

​
Blind spots

Much of the Node.js that matters here lives where ThreatAware can’t see installed software: Until you can patch, Node.js offers no workaround. As a stopgap, reject requests with Content-Encoding: br at your reverse proxy, load balancer or middleware. That doesn’t protect Brotli responses your applications fetch from other servers.
An empty list doesn’t mean you’re done. Check the blind spots above, rebuild and redeploy container images, and restart long-running Node.js processes after upgrading.

​
Sources