TrendAI™

See the Risk.
Own the Response.

Understand Node2Shell exposure and take the next step with guidance from TrendAI™ security experts.

Check your websiteSee affected versionsTrendAI Vision One™
  • 1Node.js advisory
  • Highofficial severity
  • 0exploit payloads sent
CVE-2026-111497Illustrative attack path
01 / UNTRUSTED INPUTAttacker-controlled Brotli data

Malformed compressed content

02 / REACHABLE DECODERAffected Node.js runtime

Application passes data to the Brotli decoder

03 / POSSIBLE IMPACTMemory corruption · Potential RCE

Process crash or disclosure of process memory

Vulnerability conditions, not a scan result. Exposure depends on the deployed runtime and application decoding paths.

Could your website be exposed?

Enter your website URL for a non-invasive response check. It identifies Node.js technology indicators (Express, Next.js); it does not confirm the runtime version, patch status, or Brotli exposure.

Public website only

Checks the URL you provide and its redirects.

Evidence, not exploits

Reads HTTP headers and a bounded HTML sample.

Verify your patch status

Signals do not confirm vulnerability or safety.

What is Node2Shell? Affected Node.js release lines and fixes

Node2Shell refers to CVE-2026-111497, a flaw in the Brotli decoder bundled with Node.js. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, potentially causing a crash, disclosure of process memory, or remote code execution. A framework header alone does not establish vulnerability.

Read the Node.js security advisory of October 21, 2026 for the official conditions and release details.

Affected supported Node.js release lines and fixes for CVE-2026-111497
Node.js release lineAffected versionsFixed in
22.xBefore 22.23.422.23.4
24.xBefore 24.22.124.22.1
26.xBefore 26.12.126.12.1

Use a supported, updated Node.js release. Verify vendor backports and the runtime used by the running application. Express or Next.js indicators do not disclose the Node.js runtime version or prove that untrusted Brotli data reaches a decoder.

Advisory details

Node2Shell: decoding paths and deployment checks

CVE-2026-111497 ↗Node.js severity: High

Brotli decoder out-of-bounds write

Applications that decode attacker-controlled Brotli data on an affected Node.js runtime may be exposed to memory corruption and remote code execution.

Decoding paths to review
  • Incoming request bodies decoded by configured middleware
  • External compressed responses consumed by the application
  • Direct Brotli decompression through node:zlib
After updating Node.js
  1. Rebuild applications and images that bundle the runtime.
  2. Redeploy and restart affected services.
  3. Verify the runtime used by each running application.
See affected versions and fixes
Technical details & severity sources

An invalid block switch is treated as a temporary need for more input instead of a permanent format error. The streaming decoder continues appending bytes to an eight-byte internal buffer.

Node.js rates this issue High. Separately, Google CNA assigns CVSS v4.0 9.2 / Critical. These are distinct source assessments, not a Node.js CVSS score.

Assess your risk

Understand Node2Shell conditions and verify your Node.js runtime and decompression paths.

Check your website

Know your next steps

Connect with TrendAI™ security experts to understand your risk and explore next steps.

Talk to TrendAI™

Understand your risk
Stay protected

Talk to TrendAI™Start free trial
Know before you scan

Local Scan Terms & Conditions

Authorized Use

Only run this scanning tool on systems you own or are explicitly authorized to assess. By proceeding, you confirm that you have the necessary permissions to perform the scan and share its results with TrendAI™.

Data Collection & Use

The scanning tool collects the following information from the scanned system:

This information, together with your submitted email address, will be transmitted to and stored by the TrendAI™ portal for the purpose of providing and displaying your scan report.

How the Scan Works

The scanning tool runs locally within your environment. The TrendAI™ portal receives and displays the scan results but does not remotely execute commands on your system.

Scan Limitations

Node2Shell displays agent-reported findings; Node.js assessment support has not yet been verified. Findings do not guarantee detection of all vulnerabilities or prove that a system is vulnerable, exploitable, or secure. Independently verify configuration, installed software versions, and security patch status.

Your Acknowledgment

By proceeding, you confirm that you are authorized to scan the target system and consent to the collection, transmission, and processing of the information described above.
Know before you scan

Terms of Service

Service Scope & Nature. This service operates strictly as a passive data auditor. This service performs standard HTTP GET requests against the submitted publicly accessible website. It validates each redirect destination and follows a defined maximum number of redirects. The scan inspects response headers and does not crawl websites, deliver exploit payloads, or verify exploitability. It does not crawl deeper pages, inject exploit payloads, verify exploitability, or disrupt server operations.

Results and Limitations. Findings are informational and should not be considered definitive evidence of vulnerability, exploitability, or security. Response indicators do not establish exploitability, and their absence does not establish that a website is secure. This check identifies Node.js technology indicators (such as Express or Next.js) only and does not confirm the installed runtime, its patch status, or Brotli decoder reachability. Independently verify the installed runtime, configuration, and vendor patch status.

No Warranties. The service and all results are provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, accuracy, and non-infringement. We do not warrant that the service will be uninterrupted or error-free, that results will be accurate or complete, or that the version information and advisory data used in the assessment are current. You are solely responsible for verifying findings and for any decisions made based on them.

Limitation of Liability. To the maximum extent permitted by law, Trend Micro will not be liable for any indirect, incidental, or consequential damages, or for any lost profits, revenue, data, or business opportunities, arising from your use of or reliance on the service or its results. Nothing in these Terms of Service limits any liability that cannot be limited under applicable law.

Advisory Reference. Node2Shell guidance references the Node.js security advisory issued on October 21, 2026. This response check identifies technology indicators only; it does not assess Node.js patch status or Brotli decompression reachability. Additional verification is required.