On 21 October 2026 the Node.js project released security updates across its supported lines, fixing ten vulnerabilities: four rated high, three medium and three low. The same day as the PHP news, it was easy to miss. It should not be.
What was fixed
The headline is a write past the end of a buffer in the Brotli decoder. Brotli is the compression format browsers use when a server replies with Content-Encoding: br. If your Node program fetches from a server it does not fully control, a hostile reply can push the decoder to write beyond its buffer. Memory-safety bugs like this are the kind attackers can sometimes turn into code execution, so treat the update as urgent for anything that makes outbound requests.
Update, 25 October: the Brotli bug has since been nicknamed Node2Shell, a public proof of concept exists, and other software that bundles Brotli is affected too. See Node2Shell: the Brotli bug reaches beyond Node.
The other high-severity fixes are in TLS name checking and DNS: places where Node decides whether the server it reached is really the one it meant to reach. Loose matching of IP addresses or unusual digits can, in the wrong setup, let a certificate be accepted for a name it should not match.
The medium and low items include a reply mix-up on kept-alive connections, a few permission-model gaps (wildcards and real-path handling), and a ZIP-handling bug. The release also updates bundled libraries: c-ares, undici, OpenSSL, SQLite and the CA certificate store.
What could happen to your code
- Services that fetch URLs (webhooks, link previews, importers, proxies) are the most exposed to the decoder bug, because the other side controls the bytes.
- Anything relying on TLS name checks for service-to-service calls should assume the old checks were looser than intended.
- Apps using the permission model to sandbox scripts should not rely on it as a security boundary until patched.
- Old Node lines that no longer get fixes cannot be patched at all. They need an upgrade, not a patch.
What to do before it matters
- Run
node -von every server, container image and CI runner. - Move to 22.23.4, 24.22.1 or 26.12.1 (the patched release of whichever line you use). If you are on an unsupported line, plan the upgrade now.
- Rebuild container images; do not only update the host. Base images carry their own Node.
- Restart processes. Run
npm auditfor your dependencies, too. - Limit what an outbound-request service may reach. An allowlist of destinations turns many of these bugs from serious into survivable.
- Pin and review: lock files committed, base image tags pinned, and automated pull requests for updates.