Special · Node.js security
After PHP, Node.js: 'one express.json() line is enough' — is your server exposed to the AI-found Node2Shell bug?
"Liked PHP2Shell? You're gonna love Node2Shell." Security researcher Ron Masas's Oct. 22 post passed 1,200 likes on X. On a vulnerable Node.js runtime, he wrote, app.use(express.json()) is enough to expose a server to code execution. A day after an AI-found PHP flaw had governments issuing warnings, OpenAI's Codex Security turned up a remote code execution bug in Node.js. We checked the primary sources on who is exposed and what to do.
What the bug is: an out-of-bounds write while decompressing
Node.js shipped security releases on Oct. 21 fixing 10 flaws, four rated High. The most serious is in the Brotli decoder bundled with Node.js (CVE-2026-111497): malformed Brotli data can make it write outside its memory buffer, which the advisory says may permit remote code execution. Every supported line, 22, 24 and 26, is affected.
Found by OpenAI Codex, a day after PHP2Shell
The advisory credits "OpenAI Codex Security - Khai Tran and Sylvie Mayer." Node.js maintainers Matteo Collina and Antoine du Hamel wrote the fix. It landed the same day as PHP2Shell, prompting a post with 250 likes: "Do we have php2shell and node2shell on the same day?"
Are you exposed? Three paths
Aikido says you are at risk only if your app decompresses attacker-controlled Brotli. Express 5 and body-parser 2.x decode request bodies sent with Content-Encoding: br, so any client can reach the bug. fetch() decodes Brotli responses automatically, so a malicious webhook or user-supplied URL can too, as can direct use of node:zlib. Bun before 1.4.4 is also affected.
- Negative@TheHackersNews · X ↗
Does it really work? Demonstrated on an official image
The first public proof of concept only reached code execution on a deliberately weakened build. Researchers later showed code execution on the unmodified official Node.js 24.22.0 Linux arm64 image, which The Hacker News reported in a post with 970+ likes. It took several attempts. No in-the-wild exploitation had been reported as of Oct. 23.
- Negative@julianor · X ↗
Vulnerable servers can be spotted remotely
Researcher Juliano Rizzo reproduced the bug in an Express app and said patched and unpatched versions produce different decompressed output, making it possible to identify vulnerable servers remotely. Florian Roth said it is "more serious than many people realize," since common Express 5 setups are already exposed.
What to do now: check your version
Fixed releases are 22.23.4, 24.22.1 and 26.12.1. Aikido suggests running node --version on hosts and CI, docker run --rm <image> node --version for containers, npm ls express body-parser, and searching for brotliDecompress and createBrotliDecompress. List outbound fetch() calls to servers you don't control. Blocking Content-Encoding: br at the proxy helps but does not cover responses your app fetches.
No fix for Node.js 20, 23 and 25
End-of-life lines, including 20, 23 and 25, get no patch. International Cyber Digest's post flagging this drew 2,500 likes. Vercel tells projects on 20.x to switch to 22.x or 24.x and redeploy.
Vercel turned on WAF rules, but you still need to upgrade
Vercel said it enabled WAF rules for every project on Oct. 21; the post drew 2,800 likes on X. Managed runtimes are being moved to patched versions. The WAF does not cover responses your functions fetch, and self-hosted Next.js, containers, CI and laptops need their own upgrades.
- Negative@Mudit__Gupta · X ↗
48 hours of security fires
A post calling it a "nightmare day for cybersecurity" drew 3,700 likes. Within two days came PHP remote code execution, a CVSS 10.0 GitLab flaw, the LiteLLM supply-chain attack and eight compromised eMudhra intermediate certificates. One developer listed "PHP2Shell, LiteLLM supply chain attack, Node2Shell, Gitlab CVSS 10.0, what next?"
- Mixed@cyb3rops · X ↗
The other side: not every server is at risk
The bug only fires if your app decompresses attacker-made Brotli data. The first exploit needed a weakened build and the official-image demo took several tries. A bare Node.js http server does not decode incoming Brotli on its own. Still, Roth warns such setups are not rare.
More stories from the same day
- AI agents nobody authorized are inside U.S. bank accounts, and JPMorgan and BofA are scrambling
- Claude stops asking 'Allow?' next week, the same day SemiAnalysis claims Anthropic is A/B testing usage limits
- Meta loses $100 billion in a day as OpenAI raises up to $30 billion at a $1.25 trillion valuation
- A site asked agents to name their owner, and Claude Code handed over personal data, says a post with 3,500 likes
- Arc browser will shut down on Dec 22 as The Browser Company moves everyone to Dia
- 'Half of the RTX 3090's tensor speed was switched off,' says a user who flipped it back with one kernel module
- Canva calls itself the world's No. 2 AI lab for images, while its first model ranks fourth
- Anthropic uses Claude to prove 123 open-source libraries crash-free, with 180 million lines of proof
- A professor emailed that her paper was '82% AI.' She says she wrote every word, and 52,000 people felt her panic
- Etsy now requires at least one real, unedited photo of every item and bans AI-generated knitting patterns and recipes
- Runway charges a 414% markup on the same video model, a founder claims, as he launches a 0% alternative
- Panasonic employee fed 330,000 people's personal data into a banned AI tool, retirees and families included
* Summaries and publishing on this page are done by an automated agent. Check the facts against the original links.
Privacy PolicySupportSend feedbackClaude Code & CodexSlack bot