Runtime inventory
Review agreed hosts, images, background workers and build tools. Identify instances, owners and required changes.
Services
Node2Shell — Node.js audit and security fix
We review your application runtime, Brotli data processing and update compatibility. The agreed delivery includes a change plan, configuration backup, rollback procedure, runtime update and functional checks. You receive a record of completed work and remaining recommendations.
Scope
- Inventory Node.js on hosts, containers and CI/CD jobs
- Assess CVE-2026-111497 exposure and Brotli decompression paths
- Plan runtime updates and review application compatibility
- Back up configuration and agree a rollback procedure
- Rebuild images, replace running instances and verify versions
- Run agreed functional checks and document results
Technology and tools
- Node.js
- Docker
- Next.js
- Express
- CI/CD
- Brotli
Audit scope
We inspect the deployed environment, not just the repository configuration.
Data paths
Review compressed requests and responses fetched from external services. Identify where untrusted data enters decompression paths.
Priorities and delivery plan
Agree update order, compatibility checks and a deployment window. Separate verified findings from areas requiring additional access.
Fix and controlled deployment
Updating application dependencies does not replace updating the Node.js runtime.
Patched release
Verify Node.js 22.23.4, 24.22.1 or 26.12.1, or a later release containing the CVE-2026-111497 fix. Choose the target line based on support and compatibility.
Replace running instances
Rebuild agreed images and redeploy services. Confirm the version of processes serving traffic and ensure subsequent deployments preserve the update.
Post-deployment checks
Check agreed APIs, authentication, jobs and integrations. Review service health and logs, then record the outcome. Suspected prior compromise needs separate investigation.
Interim measures and ongoing support
Interim changes depend on the application’s data paths and infrastructure.
Reduce exposure
Where immediate updating is not possible, assess limiting untrusted Brotli input. WAF rules and filtering do not replace the patch and may not cover outbound responses.
Legacy applications
Assess migration, dependencies and test scope for unsupported runtimes. Agree compatibility work before production changes.
Handover and maintenance
Deliver an instance inventory, change record and follow-up actions. Monitoring and recurring updates can be scoped separately.
Scope and budget
Audit and remediation scoped to your environment
Node2Shell audit
Individual quote
Inventory, exposure assessment and a remediation plan.
Fix and deployment
Individual quote
Runtime updates, image rebuilds, process replacement and agreed checks.
Migration and maintenance
Individual quote
Legacy compatibility work and separately agreed ongoing support.
Price and timing depend on instance count, infrastructure access and application compatibility. Incident response and compromise recovery require a separate scope. Updating alone does not guarantee complete system security.
ContactFAQ
Is npm audit or updating Express enough?
Neither replaces checking and updating Node.js. Dependency review is useful, but the running runtime must contain the decoder fix.
Does a WAF fix Node2Shell?
No. It may limit some incoming traffic, but does not replace the patch and may not cover data fetched from other services.
Do containers need replacing after an image update?
Yes. We verify that running instances are replaced and check the runtime actually serving the application.
Do you exploit the vulnerability on production?
The standard scope covers version and configuration review plus agreed functional checks. Offensive testing requires a separate scope and authorization.
Node.js: Security releases — 21 October 2026
Last updated: 23 October 2026