IronTree incident
Security advisory: Node2Shell / HTTP2Shell (CVE-2026-111497)
Ongoing since 02:01 PM UTC, affecting IronTree VPC Hosting and IronTree VPS Hosting.
A critical vulnerability (CVE-2026-111497) has been disclosed in the Brotli compression library used by Node.js and a number of other software platforms. Under certain conditions, an attacker could use specially crafted data to crash an affected application or potentially run code on the server. At the time of writing, no exploitation in the wild has been publicly reported. What IronTree is doing We have patched or are patching the IronTree-managed platforms that are affected. We have scanned hosted servers for affected components and will contact clients whose servers show signs of them. We are adding network-level protections where we can. What our scans can and cannot tell you Our scans can show that Node.js or related components are present on a server. They cannot tell us whether your specific application is actually exposed. That depends on how the software vendor built and configured the application. Many applications include their own copy of Node.js, which our scans may not fully detect. What we recommend Contact your software vendor to confirm whether your application is affected and when a fix will be available. Apply vendor updates as soon as they are released. Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1 or later. Don’t replace a runtime bundled inside a vendor application yourself. Wait for the vendor’s update. If you have questions or would like help coordinating with your vendor, please contact IronTree Support.
Affected components
Update timeline
- identified Oct 26, 2026, 02:01 PM UTC
A critical vulnerability (CVE-2026-111497) has been disclosed in the Brotli compression library used by Node.js and a number of other software platforms. Under certain conditions, an attacker could use specially crafted data to crash an affected application or potentially run code on the server. At the time of writing, no exploitation in the wild has been publicly reported. What IronTree is doing We have patched or are patching the IronTree-managed platforms that are affected. We have scanned hosted servers for affected components and will contact clients whose servers show signs of them. We are adding network-level protections where we can. What our scans can and cannot tell you Our scans can show that Node.js or related components are present on a server. They cannot tell us whether your specific application is actually exposed. That depends on how the software vendor built and configured the application. Many applications include their own copy of Node.js, which our scans may not fully detect. What we recommend Contact your software vendor to confirm whether your application is affected and when a fix will be available. Apply vendor updates as soon as they are released. Fixed Node.js versions are 22.23.4, 24.22.1 and 26.12.1 or later. Don’t replace a runtime bundled inside a vendor application yourself. Wait for the vendor’s update. If you have questions or would like help coordinating with your vendor, please contact IronTree Support.
Your product runs on more than IronTree
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services