Service
Node.js Security Patching Service
Node2Shell lives in the runtime. Updating npm packages won't close it, but upgrading Node will.
Node.js 22, 24, 26 · Express · Next.js
4-step process
- 4 clear stagesInventory to Confirm
- Node.js 22, 24, 26, Expressand 7 more in the stack
- 6 kinds of worklisted below
- Written estimatefixed price, before work starts
What this is
Node2Shell, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder bundled with Node.js, fixed on 21 October 2026. It matters when your code decompresses Brotli data from a source you don't control, which includes Express 5 request bodies, outbound fetch calls to third-party servers and direct use of Node's compression APIs. We inventory every Node runtime you own, work out where untrusted Brotli can reach it, upgrade to a fixed release, rebuild the container images that still hold the old one, and verify.
Who this is for
- Startups and businesses running Node.js or Next.js backends across several servers and containers
- Teams whose services fetch external URLs: link previews, webhooks, scrapers, import-from-URL features
- Companies running Express 5 with body-parser 2.x on a public API
- Founders who aren't sure how many Node versions their team has deployed
What problem this solves
If two or more of these sound familiar, it is worth a conversation.
The fix is in the runtime, not in npm
Express and body-parser upgrades don't change the decoder. Only a fixed Node.js build does.
Old images keep the old Node
Changing a version in a Dockerfile fixes nothing until the image is rebuilt and redeployed. We make sure it is.
Outbound fetch is easy to forget
You made the request, but a hostile server can still send a hostile response. We review every place your backend fetches outside URLs.
Unknown Node versions across services
CI runners, staging boxes, cron hosts and serverless images all carry a runtime. We find them all.
What Nimbryx actually builds
Every one of these is built around how your team already works.
Runtime inventory
Every Node.js version across servers, containers, CI and functions, with the ones below 22.23.4, 24.22.1 and 26.12.1 flagged.
Exposure review
Where Brotli input can reach: request bodies, fetch targets, compression use, and the Express and body-parser versions involved.
Upgrade and rebuild
Fixed Node release rolled out, base images rebuilt, services redeployed one at a time with a rollback ready.
Stopgap controls
While the upgrade is pending: rejecting Content-Encoding br at the proxy, body-parser inflate set to false, limits on outbound fetch features.
Verification
Running version confirmed inside each live container or process, not assumed from the config.
Short written report
What we found, what changed and what's left, in plain language.
How this typically works
From the first conversation to a working system.
Step 1
Inventory
You share the hosts, repos and registries. We build the list of what's actually running.
Step 2
Prioritise
Public-facing and fetch-heavy services go first. Internal tools follow.
Step 3
Upgrade
Staging first, tests run, then a staged rollout with one service at a time.
Step 4
Confirm
Version checks on live systems and a follow-up look at errors and memory after the change.
The stack we’d likely use
Mature, well-supported tools. The final choice depends on your project, and we explain it before we start.
- Node.js 22, 24, 26
- Express
- Next.js
- Docker
- PM2
- Nginx
- GitHub Actions
- AWS
- DigitalOcean
An honest note
When this isn't the right call
If your Node app never decompresses Brotli from outside and never fetches third-party content, your real-world exposure to this specific bug is low. Upgrading is still the right call because the same release fixes other issues, but we won't tell you it's an emergency when it isn't.
Not sure which side of the line you’re on? Ask us and we’ll say so.
Which Node.js versions fix Node2Shell?
22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026. Node 20 and older, 23 and 25 are end of life and will not receive a fix.
Is my Express app affected?
Reports list Express 5.0.0 to 5.3.0 with body-parser 2.0.0 to 2.3.0 as an exposed path for Brotli request bodies. Whatever your version, the real fix is the Node runtime upgrade.
Can a WAF protect me instead?
It can reduce inbound exposure as a stopgap. It doesn't cover malicious responses your server fetches from other hosts, so it's not a substitute for upgrading.
Can you do this without downtime?
For most setups, yes. We roll out one instance at a time behind your load balancer or PM2 process manager.
Ready to talk about your project?
Tell us what you're trying to build. We'll reply within one business day with honest thoughts, not a sales pitch.
- First conversation is free
- Written estimate before anything starts
- You own the code