Node2Shell: fixed versions by distro

Every tracked distribution release and image, with the package version that counts as fixed and the vendor's own page.

Last checked 23 Oct 2026 10:04 UTCLast changed 24 Oct 2026 02:18 UTC

Not re-checked since the time above. Check the official source below.

A newer official update is being verified.

Debian

2 of 8 fixed

Debian
Release	Package	Fixed version	State	Verified	Source
12(bookworm) security (LTS team)	brotli	1.0.9-2+deb12u1	Fixed	24 Oct 2026 05:03 UTC	Source
13(trixie) security	brotli	1.1.0-2+deb13u1	Fixed	24 Oct 2026 05:03 UTC	Source
12(bookworm) security (LTS team)	nodejs	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source
13(trixie) security	nodejs	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source
sid(unstable)	brotli	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source
forky(testing)	brotli	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source
forky(testing)	nodejs	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source
sid(unstable)	nodejs	No fixed version published yet	No fix yet	24 Oct 2026 05:03 UTC	Source

Debian builds Node.js against the system Brotli library; the fix ships in the brotli package. Source: “nodejs uses system provided brotli library”