---
type: "post"
id: "akamai-61-of-networks-run-node-js-versions-008841"
slug: "akamai-61-of-networks-run-node-js-versions-008841"
title: "Akamai: 61% of networks run Node.js versions affected by Node2Shell; fetch() and Express 5 expose apps by default"
description: "Akamai has published a closer analysis of Node2Shell, CVE-2026-111497, a Brotli decoder flaw in Node.js."
retrieval_nugget: "Akamai has published a closer analysis of Node2Shell, CVE-2026-111497, a Brotli decoder flaw in Node.js. Its practical significance is broader than a direct compression-library call: built-in fetch() and default Express 5 request parsing can reach the vulnerable decoder, making version inventory and exposure review urgent for Node.js teams."
published_at: "2026-10-28"
updated_at: "2026-10-28"
record_date: "2026-10-28"
date_kind: "published_at"
topics: []
entities: ["Akamai","Node.js","Node2Shell","Brotli","Express","body-parser"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Akamai reports that 61% of networks run affected Node.js versions and identifies built-in fetch() and Express 5 as default exposure paths."
prior_refs: ["memory:d63d1af3-22b8-8fc4-a3ba-58fab47a6153","memory:58b9c0ad-ec41-81f4-a653-4f57137955b5"]
source_url: "https://www.akamai.com/blog/security-research/inside-node2shell-closer-look-cve-2026-111497"
source_urls: ["https://www.akamai.com/blog/security-research/inside-node2shell-closer-look-cve-2026-111497"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:akamai-61-of-networks-run-node-js-versions-008841"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/akamai-61-of-networks-run-node-js-versions-008841/","markdown":"https://newruntime.com/posts/akamai-61-of-networks-run-node-js-versions-008841.md","json":"https://newruntime.com/posts/akamai-61-of-networks-run-node-js-versions-008841.json"}
---

# Akamai: 61% of networks run Node.js versions affected by Node2Shell; fetch() and Express 5 expose apps by default

## Retrieval answer

Akamai has published a closer analysis of Node2Shell, CVE-2026-111497, a Brotli decoder flaw in Node.js. Its practical significance is broader than a direct compression-library call: built-in fetch() and default Express 5 request parsing can reach the vulnerable decoder, making version inventory and exposure review urgent for Node.js teams.

## Summary

Akamai has published a closer analysis of Node2Shell, CVE-2026-111497, a Brotli decoder flaw in Node.js. Its practical significance is broader than a direct compression-library call: built-in `fetch()` and default Express 5 request parsing can reach the vulnerable decoder, making version inventory and exposure review urgent for Node.js teams.

## What happened

On October 21, 2026, Node.js released security updates for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. Akamai Security Intelligence Group’s October 26 analysis calls the issue Node2Shell. The CVE has a CVSS score of 9.2, while Node.js rates it high severity. Akamai says its telemetry shows 61% of networks running affected Node.js versions.

The flaw lies in the Brotli decoder provided through Node.js’s `node:zlib` module. Brotli is a compression format used, among other purposes, for HTTP content encoding. A Brotli stream can signal a block-type switch while it is being decoded. In the vulnerable condition, a block switch that the stream structure makes invalid was reported as a temporary need for more input rather than as a permanent format error. The streaming decoder could then continue appending input bytes to an eight-byte internal buffer and write beyond its end.

For an attacker, the prerequisite is the ability to provide malformed Brotli-compressed data that an application decompresses. Akamai says the outcome can be a crash, disclosure of process memory, or remote code execution, and that authentication is not required. The important operational point is that a team does not need to have deliberately adopted a Brotli decompression API to be exposed. Direct calls to `zlib.brotliDecompress()` and `zlib.createBrotliDecompress()` are one path, but they are not the only ones.

Node.js’s built-in `fetch()` automatically decompresses Brotli-encoded responses. That means a client application can be targeted through a malicious or compromised server it contacts. On the server side, Express 5 and body-parser 2 parse `Content-Encoding: br` request bodies by default in their JSON, raw, text, and URL-encoded parsers because `inflate` defaults to `true`. Any client can submit such a request. A bare Node.js HTTP server does not itself decode incoming Brotli bodies; decoding is left to the application.

Affected release lines are Node.js 26.x before 26.12.1, 24.x before 24.22.1, and 22.x before 22.23.4. Node.js fixed the problem in those three versions. Discontinued lines, including 25.x, 23.x, 20.x, and earlier, receive no fix; Node.js says discontinued lines are always affected when a security release occurs. Akamai’s recommended complete remediation is an upgrade. As interim risk reduction, teams can segment access to Node.js services and set body-parser’s `inflate` option to `false` if compressed request bodies are unnecessary; those bodies are then rejected with HTTP 415.

## What the archive adds

This is a new fact on a known Node2Shell story. Our earlier note reported that CISA added CVE-2026-111497 to KEV and that honeypots had logged exploitation attempts: [CISA adds Brotli flaw CVE-2026-111497 (Node2Shell) to KEV as honeypots log first in-the-wild exploit attempts](https://newruntime.com/posts/cisa-adds-brotli-flaw-cve-2026-111497-node2shell-4aada4/). Akamai adds the application-level paths that can make an estate exposed even without an explicit Brotli integration.

## Trend signal

No supplied pattern genuinely fits this runtime vulnerability analysis.

## Why now

The Node.js fixes were released on October 21, 2026, and Akamai’s analysis followed on October 26. The timing matters because the report identifies defaults and indirect data paths that can be missed by a simple search for direct decompression calls, while affected supported and discontinued release lines remain in use.

## Connections to other events

The archive also records a separate Brotli advisory affecting Node.js, Bun, Envoy, and Istio. Node2Shell is the Node.js-specific exposure analysis for the same CVE: it distinguishes direct decoder use from the `fetch()` and Express 5 paths that can reach it.

## Why it matters

AI application teams commonly run Node.js services for APIs, tool backends, webhooks, retrieval pipelines, and agent integrations. The immediate lesson is not merely to update a runtime image. Teams need to identify where their services accept compressed request bodies and where outbound code uses `fetch()` against systems that may be untrusted or compromised.

This is also a reminder that framework defaults become part of the attack surface. A service owner may reasonably believe it never chose to process Brotli, while Express 5 or body-parser 2 accepts and decompresses Brotli request bodies by default. Upgrade the runtime first, then verify service behavior and reduce reachable paths while rollout completes. For unsupported Node.js lines, migration is required rather than a backport expectation.

## Limits and uncertainty

Akamai’s 61% figure is telemetry from its own view of networks, not a universal measure of exposed internet services or confirmed vulnerable applications. The source does not quantify how many applications use `fetch()` against attacker-controlled origins, accept Brotli-compressed requests, or can be successfully exploited in a particular deployment. It also does not establish active exploitation in this analysis. Segmentation and disabling compressed request bodies reduce exposure, but Akamai states that upgrading to a patched Node.js version is the only complete remediation.

## Skill to build now

Create a short Node.js exposure inventory this week. Record each running version, whether it is supported, which external endpoints use Express 5 or body-parser 2, and which services make outbound `fetch()` calls to non-controlled hosts. Upgrade supported lines to 22.23.4, 24.22.1, or 26.12.1. Where an endpoint does not need compressed request bodies, test `inflate: false` and confirm that expected clients do not rely on Brotli request compression.

## Reader takeaway

Node2Shell is not only a problem for code that explicitly calls a Brotli decoder. Default decompression in Node.js `fetch()` and Express 5/body-parser 2 can create the relevant path. Patch supported Node.js releases, migrate discontinued ones, and review whether your services actually need to accept compressed request bodies.

## Open question

How many production Node.js services will discover an indirect Node2Shell path through framework defaults or outbound `fetch()` dependencies during their patch inventory?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)