Node2Shell Zero-Day Now Under Active Exploit Against Stock Node.js Servers, Patching Urged
A critical Node.js remote code execution flaw dubbed Node2Shell (CVE-2026-111497) has moved from proof-of-concept into active exploitation, with scanning and first attacks now hitting unpatched x86-64 Node.js deployments.
Security teams running Node.js are now dealing with live attacks against a previously theoretical weakness. A severe remote code execution vulnerability known as Node2Shell has moved from proof-of-concept to real-world exploitation.
Researchers tracking CVE-2026-111497 report that internet-wide scanning is underway and that the first exploit attempts are reaching exposed systems. The flaw allows remote code execution—letting an attacker run commands on a target server—without prior authentication. Early demonstrations focused on arm64 builds, but new analysis confirms that the exploit chain also works against stock x86-64 Node.js installations.
The exploit abuses how Node.js processes certain inputs to gain control over the underlying system. Once it succeeds, an attacker can execute their own code with the privileges of the Node.js process, which in many environments is enough to plant backdoors, access data or move deeper into internal networks.
Patched Node.js releases are already available: 22.23.4, 24.22.1 and 26.12.1. Any deployment running earlier versions is a candidate target. Systems are especially at risk where Node.js is embedded inside containers, third-party products or microservices that haven’t been updated in step with security advisories.
The immediate concern is straightforward. Production APIs, internal web dashboards and background services built on Node.js can all become entry points if they’re exposed to untrusted traffic and still running vulnerable versions. Unpatched servers reachable from the internet are attractive to attackers using automated mass scanning and exploitation.
Node2Shell’s emergence sits alongside analysis of another major enterprise flaw: CVE-2026-35273 in Oracle PeopleSoft, which a group known as ShinyHunters exploited using a chain of three bugs to turn a server-side request forgery issue into unauthenticated remote code execution. The two cases together underline how application-layer weaknesses are driving serious compromises.
Over the coming days, defenders will be watching for a rise in Node2Shell exploit signatures in logs, unusual outbound traffic from Node.js hosts, and signs that the exploit has been added to common attack toolkits. How quickly organisations roll out versions 22.23.4, 24.22.1 or 26.12.1—particularly inside complex containerised environments—will largely determine how many of today’s scans turn into full compromises.
Sources
- OSINT