Patch Your Node.js Servers Before They Are Hit
Node.js Security Patch and Exposure Check
A critical Node.js flaw can let attackers run code through specially crafted compressed data. We find every runtime, check which apps are really exposed, patch, and look for signs of a breach.
Node.js Security Patch and Exposure Check - Service Overview
A fixed-price check, patch and breach scan for your Node.js servers, covering up to 3 applications, so the critical Brotli flaw is closed where it matters and any damage is found early.
A critical flaw was reported in the Brotli decompression code that ships with Node.js, known as Node2Shell (CVE-2026-111497). It is triggered when Node.js decompresses data an attacker controls, and it can crash a process, leak memory, or possibly allow code to run. A proof of concept has been published.
Not every Node.js app can be reached. The flaw matters most where an application accepts compressed request bodies (for example Express 5 or body-parser 2.x reading requests marked as Brotli), fetches data from servers you do not control (including webhooks and user-supplied URLs), or passes untrusted input to the built-in Brotli functions. Many servers also run several Node.js versions at once, in containers, build runners and process managers, so the real picture is often hard to see.
This service gives you that picture and fixes what it can. We find every Node.js runtime on the server, review up to 3 applications for the routes above, and update Node.js to the fixed release where we control the server. Where patching has to wait, we add a stopgap at your proxy that blocks risky requests. We then check for common signs of a breach and send a written report with every change and what to do next.
What it does not cover
- No fix for older lines: end-of-life Node.js versions get no official fix. Moving to a supported line is a separate service, charged separately.
- Managed platforms: where your provider controls the runtime, we change the version setting if you give us access, or give you instructions.
- Cleaning a breach: if we find one, recovery is a separate service.
A proxy rule or firewall reduces exposure but does not replace updating Node.js.
Finds Every Runtime
Servers, containers and build runners are all checked.
Patched Or Mitigated
Fixed release where we control it, proxy stopgap where not.
Real Exposure Review
Up to 3 apps checked for the routes the flaw needs.
What's Included
Full Node.js Server Security Checklist (20 Items)
How It Works
Place Your Order
Buy the service for each server. Tell us the server type, hosting provider and the names of up to 3 applications. You receive a short list of the access we need.
Share Access and Runtime Inventory
You share access securely. We find every Node.js runtime on the server, including inside containers, and record the exact versions.
Exposure Review
We review up to 3 applications for the routes the flaw needs: compressed request bodies, outside fetches and direct Brotli use.
Patch, Stopgap and Compromise Check
We update Node.js where we control the server, add a proxy stopgap if patching must wait, then check for signs of a breach.
Report and Next Steps
You receive a written report with every change, the findings, and advice on upgrades, cleanup or further protection.
Not every Node.js app can be reached by this flaw. It matters most where an app accepts compressed request bodies, fetches data from servers you do not control, or passes untrusted data to the built-in Brotli functions. We check which of these apply to your apps and compare your versions with the official Node.js advisory.
Often, yes. Servers commonly have a system version, versions inside containers, and others used by process managers or build tools. Our runtime inventory finds all of them, so nothing is left unpatched by accident.
End-of-life versions have no official fix. We add a proxy stopgap and report the remaining risk. The real solution is moving to a supported release line, which is a separate service charged separately. See our web development and maintenance services.
It rejects requests whose body is marked as Brotli-compressed before they reach your application. This closes the request route only. It does not cover data your app fetches from other servers, so it is a temporary measure and not a replacement for updating Node.js.
One purchase covers one server, such as a VPS, dedicated server, cloud instance or container host, and up to 3 Node.js applications on it. If you have several servers, order one for each. For more than 3 applications on a server, contact us.
Build-only use is much less exposed, but build servers and CI runners should still run a supported, patched version. If you also want to bring an older Angular project up to date, see our Angular Version Upgrade Service.
Application processes need a restart, which can cause a brief interruption. We agree a suitable time with you first, and we keep copies of the configuration so any change can be reversed.
No. Patching closes the door but does not remove anything an attacker already left. Our breach check looks for common signs. If we find any, cleanup is a separate service, such as our Emergency Website Recovery.
Yes, it is a separate service because PHP has its own critical flaws. See our PHP Security Patch and Exposure Check.
Root or deployment access for a VPS or container host, or access to your hosting platform. Please share access only through the secure channel we send, never in the order note. Most servers are completed within 1 to 2 working days of receiving access.
- This is a one-time service at a fixed price per server. One server means one VPS, dedicated server, cloud instance or container host, and the price covers up to 3 Node.js applications running on it. Additional applications are quoted separately.
- We find every Node.js runtime in use on the server, including inside containers, and check each against the fixed releases listed in the official Node.js security advisory. We also review each application for the routes through which the flaw can be reached, such as accepting compressed request bodies or fetching from outside servers.
- Where we control the server and a fixed release exists for your release line, we update Node.js to the latest fixed release in that line, rebuild or redeploy containers where needed, and restart the application processes.
- Some Node.js release lines have no fix, including end-of-life versions. For these we apply interim mitigations, such as blocking risky requests at your proxy, report the remaining risk, and recommend moving to a supported line. Upgrading Node.js to a newer major version and fixing application compatibility is a separate service and is charged separately.
- Patching requires root, container or deployment access. On managed platforms we change the Node.js version setting where you give us access. Otherwise we provide written instructions for you or your provider. The price is the same.
- Application processes must be restarted, which can cause a brief interruption. We agree a suitable time with you first.
- The compromise check looks for common signs, such as unexpected processes, new or changed files, scheduled tasks, outbound connections and suspicious requests in the logs. It is not a full malware audit and does not guarantee that a server is clean. If a compromise is found, cleaning it is a separate service.
- We take copies of the configuration before changing it and record every change. If a change we made causes a problem and you report it within 7 days, we roll it back at no extra cost.
- A patch reduces risk from the published flaw. It does not protect against other vulnerabilities, and we cannot guarantee that no attack will succeed. Weaknesses inside your own code and third-party packages are outside this service.
- You provide server and deployment access through a secure channel. Delays caused by missing access do not count toward the delivery time. Refunds are not available once work has started.
- This service follows the master service agreement in place with Aarav Infotech, including confidentiality and data handling.
Related Services
You might also be interested in these services.
New
A fixed-price check, patch and breach scan for your PHP server, covering up to 10 websites, so the critical PHP remot...
New
A one-time Cloudflare Pro WAF hardening service that inspects every request before it reaches your website, so inject...