Node2Shell - remote code execution in the Node.js runtime

CAST position on Node2Shell (CVE-2026-111497) and the Extend Local Server release that fixes it

Overview

Node2Shell is the name given to CVE-2026-111497 external link, a vulnerability in the Brotli decoder built into the Node.js runtime. This bulletin lists which CAST products are affected and what you need to do. For the per-release status, see CVE-2026-111497 in the Security Advisories.

Severity Status Published Last updated
Critical Fix available 2026-10-28 2026-10-28

What is Node2Shell?

Node2Shell is an out-of-bounds write in the Brotli decompression code compiled into Node.js. An application is exposed when it decompresses Brotli data that an attacker controls, for example an HTTP request body sent with Content-Encoding: br. Successful exploitation can lead to memory corruption, information disclosure, denial of service or remote code execution. Because the flaw is in the Node.js runtime itself, updating npm packages does not fix it.

Node.js fixed the vulnerability on October 21, 2026 in Node.js 26.12.1, 24.22.1 and 22.23.4. See the Node.js security advisory external link.

Affected CAST products

Product Status Fixed in
Extend Local Server for Microsoft Windows (com.castsoftware.aip.extendproxy) Affected up to 2.3.3-funcrel 2.3.4-funcrel external link (Node.js 24.22.1)
Extend Local Server for Linux via Docker (castimaging/extend-proxy) Affected up to 2.3.3 2.3.4 external link (Node.js 24.22.1)
Other CAST Imaging container images Not affected - no Node.js runtime included -

Extend Local Server includes its own Node.js runtime. It is affected whether you installed it on its own or as part of a CAST Imaging deployment on Docker or Kubernetes.

What do I need to do?

If you do not use Extend Local Server, no action is required.

If you do, update Extend Local Server to 2.3.4. The update is required: no configuration change in earlier releases removes the vulnerability.

  • Microsoft Windows: follow Update Extend Local Server with the 2.3.4-funcrel release.
  • Linux via Docker: recreate the container from castimaging/extend-proxy:2.3.4, keeping the same data folder and options as described in Install Extend Local Server. If you load images manually in an air-gapped environment, pull and load the 2.3.4 image.
  • Kubernetes: in the values.yaml file of the folder you deployed CAST Imaging from, set ExtendProxyImage.tag to "2.3.4", then run helm-upgrade.sh (Linux) or helm-upgrade.bat (Microsoft Windows) from the same folder. These scripts run helm upgrade castimaging-v3 --namespace castimaging-v3 . - adapt the release name and namespace if you changed them. Only the Extend Local Server pod is redeployed; you do not need to upgrade CAST Imaging.

Your Solution Architect or CAST Professional Services can help you with the update.