AI-based offensive cybersecurity company Theori said on Sunday it has completed its own reproduction and verification of a critical vulnerability found in the Node.js runtime, widely used for web servers and backend development, and released an emergency response guide for companies and institutions. The flaw is dubbed Node2Shell (CVE-2026-111497).

The newly found Node2Shell stems from an out-of-bounds write defect in a Brotli decompression (decoder) module built into or linked to Node.js. Attackers can send maliciously crafted Brotli data without separate authentication to bring down servers in a denial-of-service attack, or seize control through memory exposure and remote code execution. Node.js classifies the risk level as "high" under its official criteria.

Affected versions include unpatched releases in the Node.js 22.x, 24.x and 26.x lines. The Node.js security team has immediately distributed security patch versions that fix the vulnerability (22.23.4, 24.22.1 and 26.12.1 or later) and is strongly recommending a full update. For Node 20 and earlier versions that are no longer officially supported, users should immediately check whether their OS distribution or LTS support provider offers security updates.

For companies that cannot patch Node.js immediately due to their system environment, Theori presented temporary mitigations at the reverse proxy level, such as Nginx, and at the application level to block attacks until patches are applied. It also opened an online diagnostic service, nodejsguard.io, that can check exposure risk to Node2Shell for free using only the service URL in operation, without installing a separate script.

Jun-oh Lim (임준오), head of AI & Cyber Research at Theori, said the Node2Shell vulnerability can automatically expose systems to attack during the process of a web framework handling responses even if developers do not directly use compression functions, making proactive blocking most important. He said the company opened a free inspection service to help diagnose attack paths as quickly as possible, and urged users to apply temporary measures and move quickly to deploy the latest patches.