{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T09:04:51.716Z",
  "tag": {
    "id": "node2shell",
    "label": "Node2shell",
    "isStack": false,
    "url": "https://pwn.watch/t/node2shell",
    "feed": "https://pwn.watch/t/node2shell/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "nodejs-october-2026-security-releases",
      "title": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases",
      "json": "https://pwn.watch/i/nodejs-october-2026-security-releases.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "patch",
      "product": "Node.js",
      "tags": [
        "node",
        "node2shell",
        "emudhra",
        "tls",
        "rce",
        "brotli"
      ],
      "cveIds": [
        "CVE-2026-111497",
        "CVE-2026-105482",
        "CVE-2026-105483",
        "CVE-2026-106069",
        "CVE-2026-105481",
        "CVE-2026-106072",
        "CVE-2026-106074",
        "CVE-2026-106070",
        "CVE-2026-106071",
        "CVE-2026-106073"
      ],
      "affectedVersions": [
        "22.x before 22.23.4, 24.x before 24.22.1, 26.x before 26.12.1",
        "End-of-life lines 20.x, 23.x, 25.x and older: affected, no fix (upgrade to a supported line)",
        "Bun before 1.4.4",
        "Google Brotli 1.0.3 to 1.2.0 (fixed 1.0.10 / 1.1.1 / 1.2.1)"
      ],
      "fixedVersions": [
        "22.23.4",
        "24.22.1",
        "26.12.1",
        "Bun 1.4.4"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-23T08:40:39Z",
      "summary": "Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "International Cyber Digest",
      "handle": "IntCyberDigest",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1831435438562615296/imkSFey2_bigger.jpg",
      "text": "‼️ After PHP2Shell comes Node2Shell, a critical bug found by OpenAI's Codex Security that can let attackers run code in Node.js apps.\n\nIt was successfuly demonstrated on the official Node.js 24.22.0 image.\n\nNode 20, 23 and 25 (all EoL) get no fix.",
      "date": "2026-10-23T03:04:00.000Z",
      "url": "https://x.com/IntCyberDigest/status/2113466440464691712",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVRKBHqXUAEVwbx.jpg"
        },
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVRKBH2XkAAjUT-.jpg"
        }
      ],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Ron Masas",
      "handle": "RonMasas",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2013355514650882048/ZAmTwrHJ_bigger.jpg",
      "text": "Liked PHP2Shell? You’re gonna love Node2Shell.\n\nWe reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!",
      "date": "2026-10-22T17:06:07.000Z",
      "url": "https://x.com/RonMasas/status/2113315979405258810",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Node.js",
      "handle": "nodejs",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2087612853830258688/JUl27p1E_bigger.jpg",
      "text": "🔐 Node.js security updates are now available!\n\nNew releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.\n\nReview the details and update your systems to stay secure.\n\n🔗 https://t.co/W4kfzx5lxz\n\n#NodeJS #Security",
      "date": "2026-10-21T22:39:27.000Z",
      "url": "https://x.com/nodejs/status/2113037478286221570",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Mark Gadala-Maria",
      "handle": "markgadala",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg",
      "text": "🚨 BREAKING: Node.js just dropped its OWN security bombshell.\n\n4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.\n\n→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated https://t.co/k3Vb8WK1eC",
      "date": "2026-10-21T17:11:48.000Z",
      "url": "https://x.com/markgadala/status/2112955022082207978",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Daily CyberSecurity",
      "handle": "Daily_CyberSec",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg",
      "text": "The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.\n\n#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity\nhttps://t.co/2Rmy6FPWq0",
      "date": "2026-10-21T15:49:04.000Z",
      "url": "https://x.com/Daily_CyberSec/status/2112934202412826673",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "5h3ll",
      "handle": "social5h3ll",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098744719451037699/D5xMv_cH_bigger.jpg",
      "text": "Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! \n\nSecurity updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.\n\nHighest severity is HIGH. Key issues include:\n•  TLS non-canonical IP address handling (CVE-2026-106069 / https://t.co/npxfOdxGdg",
      "date": "2026-10-21T12:03:43.000Z",
      "url": "https://x.com/social5h3ll/status/2112877488456044609",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVJy39RW8AApYfx.jpg"
        }
      ],
      "incident": "nodejs-october-2026-security-releases"
    }
  ],
  "changes": [
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "End-of-life Node.js 20, 23 and 25 get no fix. Anyone on them has to move to 26.12.1, 24.22.1 or 22.23.4. Bun shipped the fix in 1.4.4.",
      "body": null,
      "sourceUrl": "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too.",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Imperva Red Team (Ron Masas) names the bug Node2Shell and runs code on the official Node.js 24.22.0 image (Linux arm64) through fetch() and Express 5 / body-parser 2.x. It took several attempts; 24.22.1 rejected the same input.",
      "body": null,
      "sourceUrl": "https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Node.js published the Wednesday security releases and advisory.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node2Shell: Node.js Brotli RCE (CVE-2026-111497) + October security releases",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Node.js advisory credits OpenAI Codex Security (Khai Tran and Sylvie Mayer) with finding the Brotli RCE.",
      "body": null,
      "sourceUrl": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    }
  ]
}