Node2Shell moved from CVE-2026-111497 to KEV on October 27, 2026. Federal agencies have until November 10 to fix it. Grid owner/operators should mirror that urgency.

But most agencies can’t meet the deadline. Not because the patch doesn’t exist. Because the patch isn’t theirs to apply.

Your vendors won’t patch what you don’t ask about. Get the Node2Shell report for the exact questions to put to vendors whose products embed Node.js. [Read the report] 

It’s called Node2Shell, and being treated as a Node.js problem. But it’s much broader. Brotli is the compression built into every major browser and most of the web’s servers. Google maintains it. Its decoder has a memory flaw that lets a malicious compressed file or web response corrupt the program reading it. Node.js shipped a fix on October 21, and researchers named the bug Node2Shell. Within days it had three more names, because the same decoder is copied into Python, .NET, the data engines that read Parquet files (DuckDB, ClickHouse, Apache Arrow), the tools that open archives, and the toolkit used to build UEFI firmware. Google fixed the code in February. The release came in October.

Red Hat rates it a step below critical because nobody has published a reliable exploit. They’re right, for now. But a failed RCE still takes the application down when a hacker tries and fails. And anything that restarts itself just gives the attacker four hundred more tries.

PHP2Shell has picked up more press, but this one is just as much of a challenge, because the problem is where the fix has to come from.

A product that bundles its own copy of the decoder only gets fixed when that product ships a new version, not Google or Node.js. An operating system update does nothing for it. Your scanner won’t help either. It sees the parent product’s version, not the library inside it, and it flags patched systems as vulnerable because vendors backport fixes without changing the version number. Wrong in both directions at once. Your WAF sees inbound requests only. Not the response your application fetches. Not the file your pipeline opens.

For a federal agency or a utility, the Node.js you run yourself is the small part. The exposure is the vendor portal. The desktop app your HMI vendor built on Electron. The historian that reads Parquet. The firmware build tool. You don’t patch any of those. You hope your vendor does.

Last week the list of what needed a fix changed every day. We said it about foreign-made grid equipment in August: if you can’t answer the question quickly, that is its own finding. Same test. Different inventory.

Three questions to put to your team this week:

  • Which of our vendors’ products carry their own copy of this decoder?
  • Which of those accept files or fetch content from outside our control?
  • Who owns the answer, and when do we have it?

November 10 is a federal date. The question behind it isn’t.

Updated October 29, 2026. Relevant fixed versions include: Node.js 22.23.4 / 24.22.1 / 26.12.1 and Brotli 1.2.1

Patching the servers you know about doesn’t close the exposure inside the products you buy. See what needs to be rebuilt and what to ask your vendors. [Get the report]