Node2Shell (CVE-2026-111497): Exploited, in CISA KEV, and Bigger Than Node.js

Timeline (dates as published by each source)

Node.js runtimes: hosts, containers, single executables, your code

Linux commands; on macOS drop the -r from xargs. Run them on hosts, inside images and on CI runners. The SEA fuse string comes from the Node.js docs, and the release-URL grep works on official nodejs.org builds; I tested it against my own binary.

# 1. Every node binary on the host, version managers included
find / -xdev -type f -name node -perm -u+x 2>/dev/null | while read -r b; do
  echo "$("$b" -v 2>/dev/null) $b"
done | sort
# fixed: v22.23.4, v24.22.1, v26.12.1 · v20, v23, v25: no fix

# 2. Running containers: what is deployed, not what the tag points to today
docker ps --format '{{.Names}}' | while read -r c; do
  echo "$c $(docker exec "$c" node -v 2>/dev/null || echo 'no node')"
done
grep -rn --include='Dockerfile*' 'FROM node:' .

# 3. Single executable apps: the fuse string ends in :1 once a blob is injected
find /opt /usr/local -xdev -type f -perm -u+x -size +40M -print0 2>/dev/null \
  | xargs -0 -r grep -l 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2:1'
# official nodejs.org builds, and SEAs built on them, embed their release URL
grep -aoE 'download/release/v[0-9]+\.[0-9]+\.[0-9]+/' ./my-sea-app | sort -u

# 4. Electron apps embed their own Node: look for Electron 45.1.0,
#    44.10.0 or 43.8.4 (Node.js 24.22.1) in each vendor's release notes

# 5. Your code: direct calls to the Brotli decoder
grep -rnE 'createBrotliDecompress|brotliDecompress(Sync)?\(' src/ \
  --include='*.js' --include='*.mjs' --include='*.cjs' --include='*.ts'

The other copies: Python, the system library, .NET, Bun

The pip commands come from Aikido’s write-up. Compare distro package revisions with USN-8956-1, DSA-6582-1, DLA-4855-1 or your vendor’s notice, not with upstream numbers.

# Python: Brotli and brotlicffi compile their own copy of the decoder
pip show Brotli brotlicffi                     # fixed: 1.2.1 / 1.2.1.0
docker run --rm <image> pip show Brotli brotlicffi
grep -i brotli poetry.lock uv.lock requirements*.txt

# The system library (Ubuntu and Alpine nodejs packages link it)
dpkg -l 'libbrotli*' | awk '/^ii/ {print $2, $3}'    # Debian/Ubuntu
apk info -v 2>/dev/null | grep brotli                # Alpine: brotli-libs
rpm -q brotli                                        # RHEL family

# .NET and Bun
dotnet --list-runtimes      # fixed: 8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3
bun --version               # fixed: 1.4.4

# Node: process.version is the answer, process.versions.brotli is not
node -p "process.version + ' brotli ' + process.versions.brotli"

At the edge: refuse Brotli-encoded request bodies

Red Hat’s bulletin recommends stripping or rejecting Content-Encoding: br from untrusted clients at the proxy or load balancer. Rejecting is cleaner: a stripped header leaves the app with compressed bytes it can’t parse. $http_content_encoding is nginx’s standard variable for that request header.

# nginx, inside server {}: refuse Brotli-encoded request bodies
if ($http_content_encoding ~* br) {
    return 415;
}

# Envoy / Istio: if you configured a Brotli decompressor, remove it
# in both directions until you run a fixed release (Tenable)

In the app: Express inbound; fetch, axios and got outbound

inflate is a documented body-parser option (rejected bodies get a 415), and decompress is documented in both axios and got; the Brotli-only middleware is mine. Node’s built-in fetch() has no switch to turn decoding off: I read undici’s fetch code, and it only adds its default Accept-Encoding when you haven’t set one.

// Express 5 / body-parser 2: refuse every compressed body (same for raw, text, urlencoded)
app.use(express.json({ inflate: false }));

// ...or refuse only Brotli, before any parser, and keep gzip and deflate
app.use((req, res, next) => {
  if (/\bbr\b/i.test(req.headers['content-encoding'] || '')) return res.sendStatus(415);
  next();
});

// Outbound: stop asking for br (helps with honest servers only)
const response = await fetch(url, { headers: { 'accept-encoding': 'gzip, deflate' } });

// axios and got: no automatic decoding for URLs you do not control
await axios.get(url, { decompress: false });
await got(url, { decompress: false });