Node.js Update: Patch the Node2Shell RCE Tonight — Self-Hosted Fix Guide (CVE-2026-111497)

说明与用途

将所有 Node.js 实例更新至 22.23.4、24.22.1 或 26.12.1，以消除 Node2Shell（CVE-2026-111497）漏洞。

问题

Node.js 24.22.0 Docker image is vulnerable to remote code execution via Brotli decoder (CVE-2026-111497).

结果

All Node.js runtimes in the environment are patched to the latest security releases, eliminating the Node2Shell RCE vulnerability.

工作流

• Audit host Node version with node -v
• Audit container Node versions with docker run --rm <image> node --version and docker exec <container> node --version
• Identify containers older than patched versions or on EOL lines
• Pull latest images with docker compose pull
• Restart containers with docker compose up -d
• Verify running containers are patched
• If using pinned base images, update Dockerfile to new patch version and rebuild with docker build --no-cache -t <image>
• For EOL base images, migrate to supported line or sandbox
• Apply temporary reverse‑proxy rule to reject Brotli request bodies if patching delayed
• Verify all runtimes with node -v and docker exec <container> node --version

证据

Node2Shell is CVE-2026-111497, an out-of-bounds write in Node.js's bundled Brotli decoder.

来源

The fixed builds are 26.12.1, 24.22.1 and 22.23.4.

来源

Imperva demonstrated RCE against the official Node.js 24.22.0 Linux arm64 image and confirmed the fixed 24.22.1 rejected the same input.

来源

If you build your own images, check your base-image pins. A Dockerfile pinned to node:24.22.0 stays vulnerable no matter how often you rebuild it.

来源