NodeJS Brotli RCE Vulnerability CVE-2026-111497 Node2Shell - Patch Status

Ultra Web Hosting servers are fully patched against CVE-2026-111497, the October 2026 Node.js Brotli decoder remote code execution vulnerability nicknamed "Node2Shell". Every affected server across our shared, reseller, and managed fleet was updated and verified, so if you run a Node.js application with us there is nothing you need to do. This article explains what the flaw is, who it affects, and how we handled it.

01. What CVE-2026-111497 (Node2Shell) is

In October 2026, a critical vulnerability was disclosed in the Brotli decompression library that Node.js uses, tracked as CVE-2026-111497 and nicknamed "Node2Shell". It carries a CVSS severity score of 9.2 (Critical).

The flaw is an out-of-bounds write in the Brotli decoder. When the decoder processes a malformed, specially crafted Brotli-compressed stream, it can write past the end of the memory buffer it allocated. That memory corruption can crash the process, leak data, or in the worst case let an attacker run their own code (remote code execution).

Brotli is a compression format widely used on the web. In a Node.js application the vulnerable decoder can be reached in two ways:

• Directly - when your code decompresses Brotli data through the built-in node:zlib module.
• Automatically - when your app makes an outbound request with fetch() and the remote server replies with Content-Encoding: br, Node decompresses it for you.

The same underlying bug lives in the standalone Google Brotli library (versions 1.0.3 through 1.2.0), so it also affects other software that links against it, such as web servers and command-line tools. The Node.js project shipped fixes in versions 22.23.4, 24.22.1, and 26.12.1, and the Brotli library was fixed in 1.0.10, 1.1.1, and 1.2.1.

02. Who is affected

The flaw is in the Node.js runtime and the Brotli library, not in any one application. What matters for you is whether the server was patched, and it was.

If your site is static HTML or a PHP application (including WordPress) and you do not run any Node.js, the Node runtime is not in your request path at all. You are still covered either way, because we also patched the system Brotli library that other server software uses. For the PHP vulnerabilities disclosed at the same time, see PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619.

03. How Ultra Web Hosting responded

Security patching on our shared and managed infrastructure is centralized, so our customers were covered without doing anything. For this CVE:

1. Updated the Node.js runtimes - the Node versions available to customer applications were updated to the patched builds across every server that offers Node.js.
2. Patched the system Brotli library - the shared Brotli library used by other server software was updated on the same pass, closing the bug outside Node as well.
3. Rolled it across the fleet - every affected server was updated, not just one, and applications were restarted so they run on the corrected runtime.
4. Verified - we confirmed the patched build landed on each server by its security changelog, not by the version number alone.

04. Why a firewall alone cannot fix this one

Our servers run a web application firewall (ModSecurity with Imunify360), and it is a valuable layer against inbound web attacks. For this particular flaw, though, it is important to be straight with you about its limits:

• The bug can be triggered by Brotli data your application receives on an outbound connection (a fetch() call to another server). A firewall sits in front of inbound traffic to your site, so it cannot see or filter that response.
• The malicious input is a crafted compressed stream rather than a recognizable attack string, which makes a reliable blocking signature difficult.

For those reasons we did not rely on a firewall rule as the answer here. The real fix is patching the Node.js runtime and the Brotli library, which we have done fleet-wide. The firewall remains in place as defense in depth for everything else. You can read more about our firewall in Firewall and Security Protection.

05. What you need to do

On our shared, reseller, and managed hosting, nothing. The Node.js runtime and the Brotli library are patched for you.

One distinction worth understanding: a runtime patch protects the shared software stack. It does not fix a vulnerability inside your own application's dependencies. So while you do not need to update Node itself, it is still good practice to:

• Keep your project's npm dependencies current, and remove packages you no longer use.
• If your app bundles its own copy of a Brotli library through a dependency, update that dependency too.
• Review our Node.js guides for deployment and configuration best practices: Getting Started with NodeJS and Deploying NextJS and React Dashboards.

06. Running your own Node.js on a VPS or dedicated server

On an unmanaged VPS or dedicated server, you control the Node.js installation, so updating it is your responsibility. To confirm and update:

• Upgrade Node.js to a patched release: 22.23.4, 24.22.1, or 26.12.1 (or the backported security build from your Linux distribution), then restart your application.
• If other software on the box links against the system Brotli library, update that package too (fixed in Brotli 1.0.10, 1.1.1, and 1.2.1) and restart the affected services.
• Confirm the fix landed by checking the package changelog for a CVE-2026-111497 entry rather than relying only on the version number.
• Not sure whether your plan is managed or unmanaged? Open a ticket and we will confirm and tell you exactly what, if anything, is on your plate.

07. Frequently asked questions

Are Ultra Web Hosting servers patched against CVE-2026-111497?

Yes. Every server that runs Node.js applications was updated to the patched Node.js runtime, and the system Brotli library was patched as well, across the whole fleet. No customer action is required on shared, reseller, or managed plans.

What is Node2Shell?

Node2Shell is the nickname for CVE-2026-111497, a critical out-of-bounds write in the Brotli decoder used by Node.js. A crafted Brotli-compressed stream can corrupt memory and potentially lead to remote code execution. It was disclosed in October 2026 with a CVSS score of 9.2.

Do I need to update my Node.js version to be safe?

No. On our managed infrastructure the fix is backported into the Node.js version you already run, so the version string may look unchanged while being fully patched. There is nothing to select or update on shared, reseller, or managed hosting.

A scanner flagged my Node.js version for CVE-2026-111497. Is it a false positive?

If you are on our hosting, yes, it is almost certainly a false positive caused by the scanner reading the version string instead of the patched build. The vulnerability is fixed on the server. If you want human confirmation, open a support ticket.

Does your firewall block this vulnerability?

Our firewall is a useful layer, but this flaw can be triggered by Brotli data received on an outbound connection that a firewall cannot inspect, and the malicious input is hard to signature reliably. That is why we patched the runtime and the Brotli library directly rather than relying on a firewall rule. The patch is the real fix and it is in place.

Quick Recap

If you only remember a few things from this guide:

1. Our servers are patched against CVE-2026-111497 (Node2Shell), Node.js runtime and system Brotli library both.
2. No action is required on shared, reseller, or managed plans.
3. Your version string may look unchanged and still be patched, the fix is backported into your existing version.
4. A firewall is not the fix here, because the flaw can be triggered over outbound connections, patching the runtime is.
5. Running your own Node on an unmanaged server? Upgrade to 22.23.4, 24.22.1, or 26.12.1, and update the Brotli library.

Last updated October 2026 · Browse all General articles