Node2Shell (CVE-2026-111497) is fixed in these Node.js releases and anything newer on the same line. If your Node.js uses the system Brotli library, update that library instead.
You're exposed if a Node.js process runs a version below the fix and decompresses Brotli data that an attacker can influence. Express 5, body-parser 2 and Koa's body parser do that for incoming request bodies, and fetch(), axios and got do it for responses from other servers. [source] Patch regardless: the fix is a normal minor update.
node -v # fixed: 22.23.4, 24.22.1, 26.12.1 or later ldd "$(command -v node)" | grep -i brotli # output = uses the system Brotli library (see your distro below)
Don't rely on node -p process.versions.brotli: fixed builds still report the same Brotli version as before. Check the Node.js version.
Version managers install official builds, which bundle Brotli, so installing the newest release of your line is the fix. [source]
# nvm nvm install 24 # newest 24.x (24.22.1 or later); or 22 / 26 nvm alias default 24 # fnm fnm install 24 && fnm default 24 # n sudo n 24 # Volta volta install node@24 node -v
Warning: each project, CI runner and .nvmrc pinned to an exact older version keeps using it. Bump those pins too.
Download the installer for 26.12.1, 24.22.1 or 22.23.4 (or later) from nodejs.org and run it over your existing install, or use a package manager: [source]
# Windows (PowerShell) winget upgrade --id OpenJS.NodeJS.LTS # or with Chocolatey choco upgrade nodejs-lts -y node -v
Close every terminal, editor and service that runs node.exe first, or the installer can't replace it until they're restarted.
Homebrew has node 26.12.1, node@24 24.22.1 and node@22 22.23.4. [source]
brew update brew upgrade node # or: brew upgrade node@24 / node@22 node -v
The official node images were rebuilt with the fix, including node:24.22.1, node:22.23.4, node:26.12.1 and node:lts. [source] Pin a fixed tag, rebuild without cache, and recreate containers:
# Dockerfile FROM node:24.22.1-alpine # or node:24.22.1, node:22.23.4-bookworm-slim, ... docker build --pull --no-cache -t myapp . docker compose up -d --force-recreate # docker restart does NOT pick up a new image docker exec myapp node -v
Warning: rebuild every image that starts FROM node:, including base images other teams maintain, and any image that installs Node.js from a distro package.
NodeSource builds bundle Brotli. Its node_24.x and node_22.x repositories have fixed releases; node_20.x and older stay vulnerable. [source]
# Debian / Ubuntu with the NodeSource repo sudo apt-get update && sudo apt-get install --only-upgrade nodejs # RHEL / Fedora / Amazon with the NodeSource repo sudo dnf upgrade nodejs node -v
On node_20.x or older, switch the repository to node_22.x or node_24.x using NodeSource's setup instructions, then upgrade.
Debian's own nodejs packages use the system Brotli library, so the fix is the libbrotli1 update: 1.0.9-2+deb12u1 on bookworm (DLA-4855-1) and 1.1.0-2+deb13u1 on trixie (DSA-6582-1). [source]
sudo apt update sudo apt install --only-upgrade libbrotli1 apt-cache policy libbrotli1 # then restart every Node.js process (see "Restart" below)
Warning: Debian's tracker still lists its nodejs packages as vulnerable while noting they use the system library. Update libbrotli1 now and watch the tracker for a nodejs update. [source]
On Ubuntu 22.04 and later, Ubuntu's nodejs uses the system Brotli library and is fixed by the libbrotli1 update (USN-8956-1/-2): 26.10 1.2.0-4ubuntu0.1, 26.04 1.2.0-3ubuntu0.1, 24.04 1.1.0-2ubuntu0.1, 22.04 1.0.9-2ubuntu0.1. 20.04 and 18.04 get the Brotli fix through Ubuntu Pro. [source]
sudo apt update sudo apt install --only-upgrade libbrotli1 apt-cache policy libbrotli1
Warning: Ubuntu 20.04's nodejs package bundles its own Brotli and is listed as vulnerable. [source] Install Node.js from nvm, NodeSource or Docker instead.
Red Hat rates the issue Important. On RHEL 8 and 9 the Node.js 22 stream uses the system Brotli library while the 24 and 26 streams bundle their own; on RHEL 10 all of them use the system library. Red Hat says Node.js builds on the system library still need the brotli package updated. [source]
sudo dnf update brotli sudo dnf module list nodejs # RHEL 8/9: which stream you're on sudo dnf update nodejs rpm -q brotli nodejs
Warning: as of 27 October Red Hat's bulletin listed no errata yet and advised updating as soon as they're available. Until then, strip or reject Content-Encoding: br at your proxy (see Can't patch yet?). [source]
Amazon Linux 2023 fixed brotli (ALAS2023-2026-3334) and nodejs24 (ALAS2023-2026-3330). nodejs22 is listed as not affected. [source]
sudo dnf check-release-update sudo dnf upgrade --releasever=latest brotli 'nodejs24*' node -v
Warning: Amazon lists "No Fix Planned" for AL2023's default nodejs and nodejs20 packages. [source] Move to nodejs22 or nodejs24.
Alpine has brotli-libs 1.1.1-r0 in v3.22 and 1.2.1-r0 in edge, with nodejs 22.23.4-r0 in v3.22 and 24.22.1-r0 in edge. [source] Update both:
apk update apk upgrade brotli-libs nodejs # or nodejs-current node -v
Most Alpine Node.js runs in containers: rebuild the image instead (see Docker).
Node.js 20 reached end of life on 30 April 2026. It and every older line (and 23 and 25) bundle the vulnerable decoder and get no upstream fix. [source] Your options:
libbrotli1 update above. [source] [source]The bug is in Brotli itself, so other software that embeds it needs its own update. [source]
# Bun: 1.4.4 or later, then rebuild anything made with "bun build --compile" bun upgrade # Python: Brotli 1.2.1 / brotlicffi 1.2.1.0 pip install --upgrade 'brotli>=1.2.1' 'brotlicffi>=1.2.1.0' # Go: andybalholm/brotli v1.2.7 go get github.com/andybalholm/brotli@v1.2.7 && go mod tidy
Envoy is fixed in 1.36.12, 1.37.8, 1.38.6, 1.39.3 and 1.40.0, and Istio in 1.29.9, 1.30.6 and 1.31.2. [source] Bun 1.4.4 was released on 22 October. [source] Python Brotli 1.2.1 is on PyPI. [source]
Running processes keep the old code until they restart, including after a libbrotli1 update. [source]
# systemd services
sudo systemctl restart myapp
# PM2: restart the daemon itself on the new Node.js, then the apps
pm2 update
# Docker / Kubernetes: recreate from the rebuilt image
docker compose up -d --force-recreate
kubectl rollout restart deployment/myapp
# Anything still mapping an old, replaced Brotli library
sudo lsof -nP 2>/dev/null | grep libbrotli | grep '(deleted)' | awk '{print $1, $2}' | sort -uReject Brotli-encoded request bodies before they reach Node.js. This reduces exposure but doesn't replace patching, and it doesn't protect Brotli responses your application fetches from other servers. [source] [source]
# nginx (server block)
if ($http_content_encoding ~* "br") { return 415; }
# Apache
RewriteEngine On
RewriteCond %{HTTP:Content-Encoding} br [NC]
RewriteRule ^ - [R=415,L]// Express: add before any body parser
app.use((req, res, next) => {
if (/\bbr\b/i.test(req.headers['content-encoding'] || '')) return res.status(415).end();
next();
});Also avoid calling zlib.brotliDecompress() or zlib.createBrotliDecompress() on untrusted data. [source]