Node2Shell — Glossary

The longer version

Node2Shell, also called HTTP2Shell, is a widely used name for CVE-2026-111497. The underlying flaw is an out-of-bounds write in the native Google Brotli decoder: specially crafted compressed input can cause the decoder to overwrite memory it does not own. Node.js disclosed the issue in its October 21, 2026 security release.

In affected Node.js applications, the dangerous path can be reached when attacker-controlled Brotli-compressed data is passed into decompression functions such as those exposed by node:zlib. Outcomes can include a process crash, memory disclosure or, depending on conditions and protections, arbitrary code execution. Because Brotli is also bundled or linked into other software, exposure is not confined to Node.js.

An installed Brotli library or a website that sends Brotli-compressed responses is not, by itself, proof that a remote attacker can trigger the flaw. A real exposure assessment must identify which decoder version runs, whether untrusted compressed data reaches it, and whether the application actually decodes that data. The presence of a public exploit or an advisory does not alone establish a breach of a particular system.

Apply vendor-fixed runtime and Brotli library updates, rebuild and redeploy containers and packaged dependencies, and verify the versions loaded by running processes. Where an affected decoder cannot yet be patched, prevent untrusted Brotli decompression until a suitable vendor mitigation is available. Investigate possible compromise separately from verifying that the patch is installed.

Where we use “Node2Shell”

CybersecurityPHP2Shell and Node2Shell: The Complete Guide
PHP2Shell and Node2Shell are two separate flaws, both exploited and both patched on 21 October 2026. Here is who is affected, what to update, and how to check for earlier compromise.
Nov 7, 2026Key term
CybersecurityHow to Check and Update Node.js for Node2Shell
Node2Shell lives in the Brotli decoder bundled with Node.js, so the fix is a runtime upgrade, not an npm update. Here is how to patch hosts, containers and CI, and prove the running process is fixed.
Nov 7, 2026Key term
CybersecurityHow to Verify Your PHP2Shell Patch Beyond php -v
The PHP in your terminal may not be the PHP serving your site, and a patched build can keep an old version number. Here is how to verify the build that actually runs.
Nov 6, 2026
CybersecurityPHP2Shell on PHP 8.1 and Older: What to Do Now
PHP 8.1 and older got no official PHP2Shell fix, so vendor backports, request limits and reduced exposure decide how safe you are today.
Nov 5, 2026
CybersecurityDoes a WordPress Update Fix PHP2Shell? No
PHP2Shell sits in PHP, not WordPress, so only a patched PHP runtime fixes it. Here is how to check your build and what WordPress itself still needs.
Nov 5, 2026

The longer version

Where we use “Node2Shell”

Get the Core in your inbox.