Finding every Node.js runtime in your AWS account after Node2Shell (CVE-2026-111497)
Node.js fixed a Brotli decoder flaw that can lead to code execution, and Node.js 20 gets no patch. A checklist with AWS CLI commands to find every Lambda function, container and server running Node.js, and what to update first.
On October 21, 2026 Node.js shipped fixes for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with the runtime. Node.js rates it high and says it permits remote code execution. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older lines reached end of life and do not get the fix.
The bug lives in Node.js itself, so
npm update does not help. What you need is an inventory: every place in your account where a Node.js runtime is running, and which version it is. This is the checklist I use.When is an application actually exposed?
The decoder is reached when Node.js decompresses Brotli data. The exposure that matters is Brotli coming from someone you do not control:
- Compressed request bodies. Express 5 and body-parser 2 decompress bodies sent with
Content-Encoding: br. Anyone on the internet can send one. - Third-party responses. The built-in
fetch()advertises and decodes Brotli. Link previews, webhook senders and scrapers that fetch user-supplied URLs are the interesting case. - Direct zlib use.
zlib.brotliDecompress()orzlib.createBrotliDecompress()on uploads or external data.
A service that does none of these has low exposure. It still needs the update, just not tonight.
1. Lambda: list functions by runtime in every Region
Managed runtimes
nodejs22.x and nodejs24.x get security patches applied by AWS unless you pinned the runtime version with runtime management controls. nodejs20.x was deprecated on April 30, 2026: functions keep running, but Lambda no longer patches the language runtime.1
2
3
4
5
for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
aws lambda list-functions --region "$r" \
--query "Functions[?starts_with(Runtime, 'nodejs')].[FunctionName, Runtime]" \
--output text | sed "s/^/$r\t/"
done
Anything showing
nodejs20.x or older goes to the top of the list. For functions packaged as container images, Runtime is empty: check the base image and rebuild.2. Containers: check the image, not the tag
A
node:22 image built before October 21 is still vulnerable. List what your ECS services are running:1
2
3
4
5
aws ecs list-task-definitions --status ACTIVE --query 'taskDefinitionArns[]' --output text |
tr '\t' '\n' | while read td; do
aws ecs describe-task-definition --task-definition "$td" \
--query 'taskDefinition.containerDefinitions[].image' --output text
done | sort -u
Then confirm the real version inside a running task (
node -v with ECS Exec) or rebuild from a fresh base image and redeploy. Amazon Inspector also reports vulnerable Node.js packages in ECR images if container scanning is turned on.3. EC2 and Lightsail
If the instances run the SSM Agent with Inventory enabled, you can query installed applications instead of logging in to each box. Otherwise
node -v on the instance, checking the binary the service actually starts (nvm installs often differ from the system one).4. Stopgap if you cannot update today
Reject request bodies with
Content-Encoding: br on routes that do not need them, at the load balancer, in AWS WAF or in code. It lowers the risk; the decoder is still vulnerable until Node.js is updated.Sources
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article