Node2Shell Is Live, and the Next Node.js Patch Lands November 11
Node.js will push high-severity fixes to all three supported lines on November 11. Nobody outside the project knows what’s broken yet. Meanwhile, last month’s Brotli bug has public exploit code, a CISA deadline, and live attack traffic.
What Happened?
The Node.js November security release will ship new builds for 26.x, 24.x, and 22.x on or shortly after Wednesday, November 11. The advance notice, last updated November 3, rates the worst issue in each line as High. That’s all it says. No CVE IDs, no affected modules, no bug count.
End-of-life lines (Node 20, 23, and 25) are always counted as affected when a security release lands. They won’t get a fix.
Three lines get fixes. Three get nothing.
Find your version, then check two things: did you take the October patch, and are you ready for November 11?
Node.js counts every end of life line as affected by each security release. The only fix is migrating.
Why October Still Matters More
The October 21 release patched 10 flaws, four of them High. The headliner was CVE-2026-111497, nicknamed Node2Shell: an out-of-bounds write in the bundled Brotli decoder, scored 9.2 on CVSS 4.0. A crafted compressed request body or fetched response can crash the process, leak memory or, on the right build, hand over a shell.
Here’s the uncomfortable part. The upstream fix had been sitting publicly in Brotli’s code since February 27, eight months before anyone shipped it. Proof-of-concept code reached GitHub within days of disclosure. On October 26, threat researchers caught live exploit traffic from an IP already seen probing VPN gateways. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27 and gave federal agencies until November 10 to patch.
That’s one day before the next wave arrives.
Eight months public. Exploited in five days.
The Brotli fix behind Node2Shell sat in plain sight long before anyone shipped it. Then the clock sped up.
- Feb 27Brotli fix committed upstreamReadable by anyone, no release, no advisory
- Oct 21Node.js patches 10 flaws, four HighNode2Shell fixed in 26.12.1, 24.22.1, 22.23.4
- Oct 22Proof of concept code hits GitHubDecoy networks log exploitation attempts within 24 hours
- Oct 26Live exploit traffic confirmedSource IP already linked to VPN and PHP2Shell probing
- Oct 27CISA adds CVE to KEV catalogFederal patch deadline set for November 10
- Nov 3November advance notice publishedHigh severity in 26.x, 24.x and 22.x, no details
- Nov 11Next Node.js security releaseEOL lines 20, 23 and 25 affected, no fix
If you skipped October, you’re two releases behind before the November builds even land.
What’s the Impact?
Any Node.js 22.x, 24.x or 26.x build older than the October patches is exposed if it decompresses untrusted Brotli data. Think Express 5 apps and fetch() clients. Failed attempts still crash workers, so attackers get denial of service for free. In the first 24 hours, one decoy network logged 402 events from 20 IPs, 60% of them exploitation attempts.
Disclosure to attack took less than a day.
One global decoy network started logging Node2Shell traffic within 24 hours of the October 21 disclosure.
Most of those requests weren’t scouting. They were already swinging.
And it doesn’t stop at Node. PHP for Windows, .NET, Envoy, Istio, and Python Brotli packages all needed their own fixes.
How to Avoid This
- Upgrade now to 26.12.1, 24.22.1, or 22.23.4, then schedule the November 11 builds.
- Move off Node 20, 23, and 25. They stay vulnerable with no patch coming.
- Can’t patch today? Block Brotli-encoded requests at the proxy or WAF, or turn off Brotli decoding.
- Rebuild container images and lockfiles. A patched host running an old image is still exposed.
- Hunt for Node processes spawning shells and for worker crash loops after compressed traffic.
Two Patch Waves in 21 Days. Who’s Chasing Them?
Every Node build tucked inside a container, CI runner or forgotten microservice becomes a ticket somebody has to chase. Secure.com puts governed AI Teammates on that grunt work while your team keeps the final say.
- Cloud Teammate finds every workload running a vulnerable Node.js or Brotli build, stale images included, and opens the fix with full context.
- Red Teammate tests exposed endpoints the way an attacker would, inside the scope you approve, then hands defenders the path to close.
- SOC Teammate watches for Node processes spawning shells or crash-looping, and escalates to a human under your approval rules.
- GRC Teammate ties each upgrade to evidence, ready for KEV deadlines and audits.
Attack. Harden. Prove. Repeat.
The Bottom Line
The November fixes are coming Wednesday. Node2Shell is already here. If your servers still run September builds, the next patch isn’t your biggest problem. Last month’s is.
