Node2Shell (CVE-2026-111497): Fixed in Node.js 22, 24 and 26, With No Official Fix for End-of-Life Node 20 and 18

By Scott Bissett  ·  Published: October 25, 2026  ·  EOL Watch  ·  The flaw, affected lines and fixed releases read on the day of publication from the Node.js project's October 21, 2026 security release; release-line dates from the Node.js release schedule, read twice and re-checked at every build; KEV checked against CISA's live catalog.

Node.js 20 and Node.js 18 get no official fix for CVE-2026-111497, the Brotli decoder flaw dubbed Node2Shell. The Node.js project's October 21, 2026 security release fixed it in Node.js 22.23.4, 24.22.1 and 26.12.1, and lists it as affecting the 26.x, 24.x and 22.x lines. The same release notes that End-of-Life versions are always affected when a security release occurs. Node.js 20 reached end of life on April 30, 2026 and Node.js 18 on April 30, 2025, so no Node.js release will carry the fix for either. Live status and EOL Risk Scores are on the Node.js page.

Key Dates at a Glance

• Node.js 26: active support ends 2027-10-20; end of life 2029-04-30
• Node.js 24: active support ends 2026-10-20; end of life 2028-04-30
• Node.js 22: active support ends 2025-10-21; end of life 2027-04-30
• Node.js 20: active support ends 2024-10-22; end of life 2026-04-30
• Node.js 18: active support ends 2023-10-18; end of life 2025-04-30

Which Node.js lines get a fix

What the flaw is

The Node.js advisory describes a flaw in the Brotli decoder bundled with Node.js: malformed compressed input could make the streaming decoder keep appending bytes to a small internal buffer and write past its end. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which Node.js says can lead to a crash, disclosure of process memory or remote code execution. The project rates it High.

Exposure depends on whether an application decompresses Brotli data it does not control, directly through node:zlib or through a library or HTTP client or server that decodes Brotli-compressed bodies for it. The flaw is in the Node.js runtime itself, so updating npm packages does not fix it.

Node.js 20 and 18: no official fix

The Node.js project fixes security issues only on supported lines. Node.js 20, end of life since April 30, 2026, and Node.js 18, end of life since April 30, 2025, therefore get no Node.js release for CVE-2026-111497. Neither do the odd-numbered lines 25, 23 and 21.

Two routes remain for systems still on 20 or 18: upgrade to a supported line (22, 24 or 26, each fixed in this release), or use commercial extended support, which exists for both lines. Our Node.js end-of-life guide covers the upgrade path and the support options, and the Node.js 18 vendor guide compares extended support for 18.

Exploitation status

CVE-2026-111497 is not in CISA's Known Exploited Vulnerabilities catalog as of the catalog dated October 23, 2026. Imperva's Red Team, which named the flaw Node2Shell, reported a laboratory proof of code execution against the official, unpatched Node.js 24.22.0 Linux arm64 image, noting that it did not succeed on every attempt and that the fixed 24.22.1 rejected the same input. Neither the Node.js project nor CISA reports exploitation in the wild.

What to do

1. Find every Node.js runtime: node --version on servers, the base image tag in containers, and any runtime bundled inside desktop or serverless packaging.
2. On 22, 24 or 26: update to 22.23.4, 24.22.1 or 26.12.1 or newer, and rebuild container images.
3. On 20 or 18: plan the upgrade to 22, 24 or 26 now, or put the system under commercial extended support; until then, avoid decompressing untrusted Brotli data.
4. Check the rest of the estate with the EOL Checker and the Node.js end-of-life guide.

Frequently Asked Questions

Related

• Node.js end of life — every line, its dates and the support options
• Node.js 18 extended support — vendors compared
• PHP2Shell — the same end-of-life gap, in PHP