Urgent Security Advisory: Node.js Brotli Flaw CVE-2026-111497 Disclosed — Critical Runtime Upgrade Guide
The Node.js project has released emergency security releases across 22.x, 24.x, and 26.x addressing CVE-2026-111497, a critical Brotli decompression memory corruption vulnerability dubbed Node2Shell.
Attackers can supply malformed compressed streams to trigger process crashes or arbitrary code execution in vulnerable Node.js instances. Traditional npm audits will fail to detect this flaw because it resides in the underlying runtime rather than third-party packages.
Executive Security Alert & Threat Overview
The Node.js project has issued an emergency high-severity security release addressing CVE-2026-111497 (commonly tracked in the security community as Node2Shell), a critical memory corruption flaw inside the runtime's bundled Brotli decompression library (node:zlib).
Under specific crafted conditions, unauthenticated remote attackers sending malformed Brotli-compressed HTTP payloads or data streams can trigger out-of-bounds heap memory corruption, resulting in immediate process denial of service (crashes) or potential Remote Code Execution (RCE).
Key Vulnerability Details
- Disclosed Date: October 21, 2026
- Vulnerability Identifier: CVE-2026-111497 / Node2Shell
- Impacted Component: Bundled C++ Brotli decompressor in
node:zlib - Minimum Security-Fixed Versions:
- Node.js 22.x: Upgrade immediately to 22.23.4 (LTS) or later
- Node.js 24.x: Upgrade immediately to 24.22.1 or later
- Node.js 26.x: Upgrade immediately to 26.12.1 or later
- Unsupported Releases (20.x, 18.x, and older): Will not receive official security patches; all production systems running older releases must migrate to a supported LTS release immediately.
Critical Distinction for DevOps & Engineering Teams
Bumping application dependencies in package.json or running npm audit will not fix this vulnerability. The vulnerability resides inside the underlying compiled Node.js executable C++ runtime. System administrators, developers, and DevOps engineers must update the actual host runtime or Docker container base images and restart running process managers.
BotDigit Platform Status
BotDigit Core & Gateways are 100% Unaffected: All critical financial, escrow, authentication, and database microservices are engineered in memory-safe Rust (Axum), eliminating runtime memory vulnerabilities by design.
Frontend & Admin Services Upgraded: BotDigit's Next.js web application and administrative portal runtimes have been audited and upgraded to Node.js 22.23.4 LTS linked with hardened Brotli 1.2.1 libraries.
Remediation & Upgrade Guidance
For complete terminal audit commands, Dockerfile patching instructions, PM2 zero-downtime reloads, and verification checklists, read the comprehensive BotDigit Node.js Runtime Audit & Remediation Guide on our Engineering Blog.