Is your Node.js affected by Node2Shell?
Am I affected?
If you run Node.js below the fixed release for your branch, update it.
- Release lines with an official fixed release: 3 of 3. 3 of them not yet confirmed by a second official source.
Runs in your browser. Nothing is sent.
CVEs in this event
| CVE | Summary |
|---|---|
| CVE-2026-111497 | CVE-2026-111497: an out-of-bounds write in the Brotli decoder bundled with Node.js. The release lines that carry the fix are listed on this page. |
Fixed upstream
Confirm it worked
-
Find the version you run. Use the command, or read it in your hosting control panel.
$ node --version Compare it with the row for your own release line or distro above. Only compare a distro package with that distro's own row.
Or paste it into the checker. It runs in your browser and sends nothing.
Questions people ask
My server shows an older version number than the fixed one. Am I still exposed?
Not necessarily. Linux distributions fix a problem inside their own package and keep their own numbering. Read the row for your distribution and release in the table, not the upstream number.
What does "One official source so far" mean?
PatchBell publishes a fixed state only when two independent official sources agree. A row with one source stays unconfirmed until a second one confirms it.
Does PatchBell scan my server?
No. Nothing here contacts your server or your site. The checker compares what you paste with the published data in your browser.
My hosting provider is not listed. What now?
Ask the provider which version your plan runs, then compare it with the table. A missing provider means PatchBell has no official statement from it, not that the plan is fixed.