Breaking

Critical Node.js Vulnerability Node2Shell Discovered; Code Execution on Version 24.22.0

October 23, 2026 at 22:44 EDT

Security
Foundation Models

A critical remote code execution vulnerability in Node.js has been identified and publicly demonstrated on the official version 24.22.0. Researchers at OpenAI's Codex Security team have disclosed CVE-2026-111497, dubbed Node2Shell, which exploits a flaw in the bundled Brotli decoder that Node.js uses for data decompression.

AI Security Alert • October 2026

Node2Shell: Critical Code Execution in Node.js Brotli

Out-of-bounds write flaw in bundled Brotli decoder demonstrated on v24.22.0; fixes available for v22.23.4, v24.22.1, v26.12.1; EOL versions unfixed.

9.2

CVSS Score

Critical Severity

3 Versions

Fixed

22, 24, 26 LTS

3 EOL Lines

No Patch

v20, 23, 25

Exposure Routes

Express 5 & body-parser 2.x decode Brotli request bodies
fetch() decompresses Brotli responses from untrusted URLs
Koa/Fastify body parsers with Brotli decompression enabled
<code style='background:#ffffff;padding:2px 6px;border-radius:4px;'>node:zlib</code> direct calls with attacker input

Mitigation (Immediate)

Upgrade Node.js/Bun to patched versions; reject Content-Encoding: br at proxies.

Risk if Unpatched

Arbitrary code execution possible via crafted Brotli streams; EOL versions permanently vulnerable.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.