Security statement: CVE-2026-111497 (Node2Shell)
This is our statement on CVE-2026-111497, the Node.js Brotli vulnerability also known as Node2Shell. Our internet-facing services were updated within 24 hours of the Node.js fix. Android builds have run on a fixed version of Node.js since November 4. Our iOS build servers are still on an affected version, and an updated iOS image is expected in beta by the end of this week. You don’t need to change anything or rotate any credentials.
The vulnerability
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder that ships inside Node.js. If an attacker can get a Node.js process to decompress crafted Brotli data, they can crash it, read some of its memory, or potentially run code in it. That includes HTTP responses received with fetch(), which decodes Brotli automatically. Node.js rates it High. The CVE record scores it 9.2 (Critical) under CVSS 4.0.
Node.js released fixes on October 21, 2026, in versions 22.23.4, 24.22.1 and 26.12.1. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27.
Details: Node.js October 2026 security releases
Where VoltBuilder uses Node.js
| Where | Status |
|---|---|
| Internet-facing services | Fixed. Updated within 24 hours of the Node.js release. |
| Android build servers | Fixed. Node.js 26.13.0 since November 4, 2026. |
| iOS build servers | Not yet fixed. Node.js 24.21.0. Updated image expected in beta this week. |
Internet-facing services
These are the ones that matter most for a bug like this, because anyone can send them data. We updated every internet-facing service that runs Node.js within 24 hours of the Node.js release. We have no evidence that any of them were exploited. We rotated our infrastructure’s private keys anyway, as a precaution.
Build servers
Cordova and Capacitor both run on Node.js, so every build uses it. We treated the build servers as lower risk than the public services, and scheduled them after, for three reasons:
- They are not reachable from the internet. Nobody can send data to a build server directly.
- Every build runs in its own container (Android) or virtual machine (iOS), which is discarded or reset when the build finishes. Nothing carries over from one build to the next.
- Outgoing network traffic from builds is limited.
To use this bug against a build, an attacker would have to get crafted Brotli data into something the build downloads, for example by compromising a package registry or the server a plugin is fetched from. That’s possible, but it isn’t the likely attack. Anyone who can tamper with a package your build installs can already run code during the install, with or without this CVE. The real risk there is a compromised npm package, and the defence is the same as it has always been: check the plugins and packages you depend on, and pin their versions.
Even in that case, the damage is limited to that one build. There is nothing on a build server for an attacker to keep, and no way to carry anything into the next build.
The Android build image was rebuilt on Node.js 26.13.0 and became the default on November 4. 26.13.0 is the first LTS release of Node.js 26 and contains the same fix as 26.12.1. We’re bringing the same version to the iOS build servers. That image is expected in beta by the end of this week. We’ll update this post when it’s in beta, and again when it becomes the default. Current versions are always on the build environment page.
What you need to do
For VoltBuilder, nothing. The keys we rotated were our own infrastructure keys. We don’t store your signing keys or certificates. You don’t need to rotate VoltBuilder API credentials, change your password, or regenerate any certificates.
Your apps aren’t affected. The apps VoltBuilder builds run in the platform’s WebView and don’t include Node.js. If you bundle a Node.js runtime into your app with a plugin such as nodejs-mobile, check that project for its own advisory.
If you run Node.js anywhere else, such as your own servers or CI, update it to 22.23.4, 24.22.1, 26.12.1 or later.
Timeline
| Date (2026) | Event |
|---|---|
| October 21 | Node.js releases fixed versions |
| October 22 | All VoltBuilder internet-facing services running Node.js updated |
| October 27 | CISA adds CVE-2026-111497 to the Known Exploited Vulnerabilities catalog |
| October 30 | First answers to customer questions on the forum |
| November 4 | Android build servers move to Node.js 26.13.0 |
| November 4 | This statement published |
| End of this week (expected) | iOS build image with Node.js 26.13 in beta |
Questions
Reply on the forum thread or email support@volt.build. Please send anything security-sensitive to the email address rather than the forum.