Node2Shell checker: is your Node.js version affected?
Paste your node -v output, a Dockerfile line or your .nvmrc and find out in a second if that Node.js version has the fix for Node2Shell (CVE-2026-111497), the Brotli decoder RCE. A static check: we don't scan or contact anything. No signup, no email needed.
Free Node2Shell check
Node2Shell, plainly
Node.js ships its own copy of Google's Brotli decompressor in node:zlib. On 21 October 2026, Node.js fixed a bug in it: malformed Brotli data made the streaming decoder keep appending bytes to an eight-byte internal buffer, writing past its end. An attacker who can get your app to decompress Brotli data they control can crash the process, read its memory, or run code. The community calls it Node2Shell; it's tracked as CVE-2026-111497 (Node.js rates it High, NVD scores it CVSS 9.2). See the official Node.js advisory.
The fix is a Node.js upgrade. Updating your npm packages doesn't change the runtime, and a running process keeps the old one until it restarts.
Which versions are affected
| Line | Status | Affected | Fixed in |
|---|---|---|---|
| Node.js 26.x | Current | below 26.12.1 | 26.12.1 |
| Node.js 24.x | LTS (Krypton) | below 24.22.1 | 24.22.1 |
| Node.js 22.x | LTS (Jod) | below 22.23.4 | 22.23.4 |
| 25.x, 23.x, 20.x, 18.x and older | End-of-life | all | no fix |
What this checks
Only the version string you type. There's no URL field: we never request your server or anyone else's, and never send Brotli data to test the bug.
- 01Affected version: a supported line, below its first fixed release. You get the exact version to upgrade to.
- 02Probably safe: at or above the fixed release for its line.
- 03Floating version: a tag like node:22 or lts/jod that resolves to whatever was newest at build time. Fixed only if built after 21 October 2026: check node -v in the running container and pin it.
- 04End-of-life and affected: Node.js publishes no fix for the line and treats it as always affected. Move to a supported LTS.
- 05Unknown: a version range (package.json engines), a line the advisory doesn't cover, or no version found. Paste node -v instead.
- 06Never "safe": a vendor build can carry a backported fix under an old number, and an affected version is only exploitable if your app decompresses attacker-controlled Brotli.
Questions
What is Node2Shell?
Node2Shell is the nickname for CVE-2026-111497, a bug in the Brotli decoder bundled with Node.js, fixed in the Node.js security releases of 21 October 2026. Malformed Brotli data can make the decoder write past the end of an internal buffer, which can crash the process, leak its memory or lead to remote code execution. Node.js rates it High; NVD scores it CVSS 9.2. The fixed releases are 26.12.1 (26.x), 24.22.1 (24.x), 22.23.4 (22.x).
Is my Node.js version affected by Node2Shell?
On a supported line, it's affected if it's below the first fixed release for that line: 26.12.1 (26.x), 24.22.1 (24.x), 22.23.4 (22.x). End-of-life lines (25.x, 23.x, 20.x, 18.x and older) get no fix: Node.js treats them as always affected, so the answer there is to move to a supported LTS. The checker above does this comparison for you.
How do I run a CVE-2026-111497 check?
Paste the output of node -v from wherever your app runs (inside the container, if it's in one) into the Node2Shell checker above. It also reads a Dockerfile line (FROM node:24.10-alpine), an .nvmrc value (lts/jod) or package.json engines.node. You get the result on the page; add an email if you also want it with the fix steps.
My Dockerfile says FROM node:22. Am I affected?
It depends on when the image was built. A floating tag like node:22, node:lts or lts/jod resolves to whatever was the newest release when the image was pulled or Node was installed. If that happened after 21 October 2026, you likely got a fixed release; if not, you're still on an affected one. Run node -v inside the running container to be sure, rebuild with docker build --pull, and pin an exact fixed version.
I'm on Node.js 20 or 18. Is there a fix?
No. Node.js 20, 18 and the odd-numbered lines (23, 25) are end-of-life, and Node.js publishes no fix for them: end-of-life versions are always affected when a security release comes out. Upgrade to a supported LTS line (24.22.1 or later, or 22.23.4 or later).
Does an affected version mean my app can be exploited?
Not necessarily. The bug is triggered when your app decompresses Brotli data an attacker controls with node:zlib: for example a request body sent with Content-Encoding: br that your server inflates, or a fetch() response from a server the attacker controls (fetch() asks for Brotli by default). Whether that's reachable depends on your code. Upgrading is still the fix, and a version number alone can never tell you you're definitely safe.
How do I fix Node2Shell?
Upgrade Node.js to the fixed release for your line or later (26.12.1 (26.x), 24.22.1 (24.x), 22.23.4 (22.x)): nvm install, your package manager, or a pinned Docker tag such as node:24.22.1-alpine. Rebuild your images with a fresh pull, redeploy, and restart every Node.js process: a running process keeps the old runtime until it restarts. On an end-of-life line, move to a supported LTS.
Does the checker scan my server?
No. It only reads the text you type into the box. It has no URL field, makes no request to your server or anyone else's, and never sends Brotli data or anything else to test the bug. Node.js doesn't report its version over HTTP anyway, so a version is something only you can read, with node -v.
Is the Node2Shell checker free?
Yes: no account, no card and no email needed. Add an email only if you want the result and the fix steps sent to you.
Same week, same kind of bug: PHP2Shell, a remote code execution flaw in PHP itself, was disclosed on 21 October 2026 too. Running PHP as well? Check it with the free PHP2Shell checker, or see all kubepath tools.