LIVENode2Shell
1,661,094
Click to copy
Node.js services potentially exposed to Node2Shell
Internet-facing services seen in the last 7 days that Shodan identifies as Node.js, or that announce Express or Next.js. Node.js doesn't reveal its version, so patched and unpatched services are both counted. A service is at risk only if it is unpatched and decompresses Brotli data an attacker can send it. CISA lists Node2Shell as exploited in the wild. [source]
1,002,194services identifying as Express, whose version 5 decompresses Brotli request bodies by defaultClick to copy
561,878services identifying as Next.js, whose server-side fetch() decompresses Brotli responsesClick to copy
CVE-2026-111497 at a glance
- What
- An out-of-bounds write in the Brotli decoder bundled with Node.js. Malformed compressed input can crash the process, leak its memory or lead to remote code execution. [source]
- Reachable when
- An application decompresses Brotli data an attacker controls. Express 5, body-parser 2 and Koa's body parser do this for request bodies before any route runs, and
fetch()does it for responses. [source] - Severity
- CVSS v4.0 9.2 (Critical). [source] Node.js rates it High; [source] Red Hat rates it Important. [source]
- Weakness
- CWE-787 out-of-bounds write and CWE-252 unchecked return value. [source]
- Exploitation
- Added to CISA's Known Exploited Vulnerabilities catalog on 27 Oct 2026. US federal agencies must fix it by 10 Nov. [source]
- Fixed in
- Node.js 22.23.4, 24.22.1 and 26.12.1, released 21 Oct 2026. [source] Also Brotli 1.0.10, 1.1.1 and 1.2.1, and Bun 1.4.4. [source]
- No fix
- Node.js 20 and older, 23 and 25 are end of life and get no upstream fix. [source]
- Reported by
- Khai Tran and Sylvie Mayer, OpenAI Codex Security. [source]
Node.js services seen by Shodan
Services seen in the last 7 days that Shodan identifies as Node.js, Express or Next.js. This tracks exposure, not patching.
1,661,094services seen in the last 7 days
Show the data
| Measured | Node.js services | Express | Next.js |
|---|