https://pwn.watch/t/node2shell Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 08:40:39 GMT https://pwn.watch/i/nodejs-october-2026-security-releases https://pwn.watch/i/nodejs-october-2026-security-releases Fri, 23 Oct 2026 08:40:39 GMT critical patch <p>Node2Shell (CVE-2026-111497, also written Node 2 Shell) is a Brotli decoder out-of-bounds write in Node.js that can let an attacker run code when an app decompresses attacker-controlled Brotli data: Express 5 / body-parser 2.x request bodies sent with Content-Encoding: br, Brotli responses read by fetch(), or node:zlib on untrusted input. OpenAI Codex Security (Khai Tran and Sylvie Mayer) reported it; Node.js fixed it on Oct 21 2026 in 26.12.1, 24.22.1 and 22.23.4, alongside nine other CVEs (TLS hostname/IP bypasses, DNS NUL truncation) and a CA store refresh for the eMudhra incident. On Oct 22 Imperva Red Team, which coined the name Node2Shell, ran code on the official Node.js 24.22.0 image. NVD lists CVSS 4.0 9.2 (critical); Node.js rates it High. End-of-life lines (Node.js 20, 23, 25 and older) get no fix: upgrade to 26.12.1, 24.22.1 or 22.23.4. Bun is fixed in 1.4.4.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 22.23.4, 24.22.1, 26.12.1, Bun 1.4.4</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: End-of-life Node.js 20, 23 and 25 get no fix. Anyone on them has to move to 26.12.1, 24.22.1 or 22.23.4. Bun shipped the fix in 1.4.4. (<a href="https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497">source</a>)</li><li>2026-10-22: NVD record for CVE-2026-111497 updated: the Google CNA scores it CVSS 9.2 (critical) and places the root bug in Google Brotli 1.0.3 through 1.2.0 (c/dec/decode.c), so other software bundling Brotli needs updating too. (<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-111497">source</a>)</li><li>2026-10-22: Imperva Red Team (Ron Masas) names the bug Node2Shell and runs code on the official Node.js 24.22.0 image (Linux arm64) through fetch() and Express 5 / body-parser 2.x. It took several attempts; 24.22.1 rejected the same input. (<a href="https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073</p>