Node.js shipped a security update on Wednesday for node2shell, the Brotli decompression flaw tracked as CVE-2026-111497. The bug can let attacker-controlled compressed data crash a process, leak memory, or reach remote code execution in affected apps.
Node.js and Bun exposure
Anyone running Node.js or Bun is affected if the app decompresses Brotli data an attacker can control. That includes code using node:zlib directly and code that lets fetch() handle Brotli-compressed responses automatically.
October 21 fix path
Node.js said every supported release line had the flaw before the October 21 update, and the runtime rates it high severity, one step below critical. The fix came from an upstream Brotli patch, which Node.js pulled in by cherry-picking Brotli commit 0ed4268a from February so the decoder stops before it writes past the buffer.
The same fix also shipped in Brotli 1.2.1, Brotli 1.1.1, and Brotli 1.0.10. For Bun users, the update path is simpler: version 1.4.4 or newer is the line that removes the flaw.
What the proof of concept showed
A first proof of concept arrived on October 22, and it reached code execution only against a deliberately unfinished target. That leaves a gap between demonstrable exploitation and the harder real-world case, but it does not change the upgrade advice for anyone who accepts attacker-controlled Brotli input.
If Node.js came from a Linux distribution package such as Debian, Ubuntu, Fedora, RHEL, or Alpine, the fix may arrive through the distribution’s Brotli package instead of the runtime alone. The practical step now is to check whether the deployed Node.js line or Bun install has moved to the patched version, because the vulnerable decoder sits in the path that handles compressed data before application code ever sees it.
