The Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch a high-severity flaw in Node.js by November 10, after confirming hackers are actively exploiting the bug in the widely used JavaScript runtime.
The vulnerability, tracked as CVE-2026-111497, sits in the Brotli decompression code bundled inside Node.js and can let an attacker corrupt a server’s memory and potentially run malicious code.
What the flaw does
Node.js disclosed the issue in an official security release on October 21, describing a flaw in the Brotli decoder bundled with Node.js that allows malformed compressed input to write past the end of an internal decoder buffer.
An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.
The bug affects all three currently supported Node.js release lines. On October 21, 2026, the Node.js Project released coordinated security updates for every active release line (26.x, 24.x, and 22.x) , fixing 10 vulnerabilities in total, with the Brotli issue rated the most severe of the batch.
Researchers have given the bug informal nicknames including Node2Shell and HTTP2Shell. Security firm Akamai, which has studied the flaw in depth, said on October 21, 2026, Node.js released security updates that fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability, named Node2Shell, allows an attacker who can supply malformed Brotli-compressed data to corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution (RCE). The CVE was assigned a CVSS score of 9.2, while Node.js itself rates the vulnerability as high severity.
Akamai also found that a large share of monitored networks remain exposed, noting that Akamai telemetry shows that 61% of networks are running affected Node.js versions.
Why CISA stepped in
Six days after the patch shipped, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, a list reserved for bugs with confirmed real-world attacks.
CISA added CVE-2026-111497 to the catalog on October 27, 2026, listing it as the Google Brotli Unchecked Return Value Vulnerability, with a due date of November 10, 2026, for federal civilian agencies. The agency’s action requires those agencies to apply the fix by that date under its binding operational directive.
The urgency stems from how quickly a working exploit emerged after disclosure. On October 26, threat intelligence firm ELLIO reported that its sensors recorded an exploitation attempt against CVE-2026-111497. ELLIO said the attempt targeted Node.js 24.22.0 on x86-64 and combined code copied from public PoCs with an original exploit chain.
Security researchers tracking the catalog entry also note that these are ELLIO’s own observations; CISA has not said what evidence it relied on, and no victim has been named.
Who is affected
Fixed versions: Node.js 22.23.4, 24.22.1, and 26.12.1.
Organizations still running older, unsupported branches are left without an official repair, since Node.js release lines that have reached end of support, including 20, 23 and 25, do not receive a fixed release, and Node.js has published no workaround.
The underlying flaw traces back further than its public disclosure date. According to reporting on the advisory timeline, the change was first made in Brotli’s source in February 2026 and shipped as a security release only in October.
Because Brotli is used far beyond Node.js, the fix also reached other software. Patches are now available for Node.js, Bun, Envoy, Istio, .NET, Python, and several Linux distributions, and Microsoft published its own advisory for the same underlying defect in .NET.
What comes next
Security teams outside the federal government are being urged to treat the November 10 date as a hard outer limit rather than a target, given how fast exploitation followed disclosure.
Node.js credited external researchers with reporting the flaw; public tracking of the advisory notes that it was reported by OpenAI Codex Security, per the CVE record and Node.js.
The episode underscores how a single component buried deep in a software supply chain, rather than a headline application, can expose millions of servers at once.
Enterprises managing large fleets of cloud infrastructure, a challenge also reflected in how companies structure developer tooling security and respond to account-level threats like the recent Microsoft 365 password spray campaign, now face pressure to inventory every Node.js instance they run and confirm each has moved to a patched release before attackers broaden their targeting.
