Node2Shell Vulnerability (CVE-2026-111497): What MioriticHost Customers Running Node.js Apps Need to Check

What happened: Node2Shell in brief

On October 21, 2026, the Node.js project released patched versions 22.23.4, 24.22.1, and 26.12.1 to address CVE-2026-111497, a critical vulnerability named Node2Shell by Akamai researchers. The flaw lives in the Brotli decoder built into Node.js and used by the internal node:zlib module. A malformed Brotli stream can trigger an out-of-bounds memory write, potentially causing a process crash, leaking data from process memory, or in the worst case enabling remote code execution. No authentication is required to trigger the bug. Akamai assigned a CVSS score of 9.2 (critical); the Node.js project rates it high. The Node.js project provides no workaround: upgrading to a patched release is the only complete fix.

Who is affected and under what conditions

• Vulnerable versions: Node.js 26.x before 26.12.1, 24.x before 24.22.1, 22.x before 22.23.4. The 25.x, 23.x, 20.x and older release lines are end-of-life and will not receive any patch.
• Highest-risk scenario: applications using Express 5 with body-parser 2, where the json, raw, text, and urlencoded parsers have the inflate option enabled by default. Any HTTP request sent with the Content-Encoding: br header is automatically decompressed, triggering the vulnerable code path.
• Also affected: Node.js fetch(), which automatically decompresses Brotli-encoded responses from external servers.
• Lower exposure: a plain Node.js HTTP server without decompression middleware does not decompress request bodies on its own and does not directly trigger the vulnerability.
• Temporary mitigation (if an immediate upgrade is not possible): set inflate: false in body-parser to reject compressed requests with HTTP 415; restrict network access to Node.js services that should not be publicly reachable.

What MioriticHost has already done

On MioriticHost shared hosting servers, the Node.js 22 and 24 versions available in cPanel through Setup Node.js App are already updated to 22.23.4 and 24.22.1 respectively, delivered through updates from our platform provider, CloudLinux. On October 29, 2026, we audited the Node.js applications hosted on our servers. Applications using Express 5 are already running on patched versions. Keeping our customers secure is our baseline, and this kind of review is part of our standard process whenever a critical vulnerability is disclosed.

What you need to do: concrete steps for shared hosting and VPS

• Shared hosting via cPanel (Setup Node.js App): Log in to cPanel and open Setup Node.js App. Check the Node.js version assigned to each of your applications. If any application is running on Node.js 20 or older, you need to move it to Node.js 22 or 24: select the new version from the dropdown, run Run NPM Install again, and restart the application. Before switching in production, verify that your application works correctly on the new version. If your application is already on Node.js 22 or 24, no further action is needed.
• Self-managed VPS: Check your installed version by running node -v. If the output shows a version older than 22.23.4, 24.22.1, or 26.12.1, upgrade immediately to the latest release in your active line (22, 24, or 26). If you are running Node.js 20.x or older, you must migrate to a maintained release line (22 LTS or 24 LTS) before you can apply the fix. The same applies to any Node.js application you host elsewhere.
• Recommended extra check: If you use Express 5 with body-parser 2, confirm your application is on a patched version. If you applied the temporary inflate: false mitigation, you can safely revert it after upgrading.

Upgrading to a patched release is the only complete fix for Node2Shell. The Node.js project provides no workaround.

If you need help migrating an application to a newer Node.js version, or have questions about your cPanel configuration, open a support ticket with the MioriticHost team and we will walk you through the steps for your specific setup. For a deep technical breakdown of the vulnerability, see the Akamai write-up: Inside Node2Shell: A closer look at CVE-2026-111497 (akamai.com/blog/security-research).