# TIPS : Node2Shell - a Dynatrace dashboard to find and fix exposed Node.js runtimes

**URL:** <https://community.dynatrace.com/t/tips-node2shell-a-dynatrace-dashboard-to-find-and-fix-exposed-node-js-runtimes/57286>\
**Category:** Dynatrace Tips\
**Tags:** data-privacy-and-product-security, dashboards\
**Created:** [October 28, 2026, 11:45am UTC](https://community.dynatrace.com/t/tips-node2shell-a-dynatrace-dashboard-to-find-and-fix-exposed-node-js-runtimes/57286 "2026-10-28T11:45:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbaudart](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@gbaudart](https://community.dynatrace.com/u/gbaudart)\
**Post date:** [October 28, 2026, 11:45am UTC](https://community.dynatrace.com/t/tips-node2shell-a-dynatrace-dashboard-to-find-and-fix-exposed-node-js-runtimes/57286/1 "2026-10-28T11:45:10Z")

</div>

🚨 After PHP2Shell, here comes Node2Shell. If you run Node.js in production: same problem, same answer.

CVE-2026-111497: out-of-bounds write in the Brotli decoder bundled with Node.js, leading to remote code execution. CVSS 9.2. Public PoC available.

✅ Patched versions: Node.js 22.23.4, 24.22.1, 26.12.1.  
❌ Node.js 25, 23, 20 and earlier: end of life, no fix. You need to upgrade.

The catch: the flaw is in the runtime, not in an npm package. A simple fetch() or Express 5 is enough to be exposed, without ever calling Brotli yourself.

📊 Same Dynatrace dashboard, adapted: active Node.js processes by namespace and by host, each version classified (vulnerable, end of life, patched, unknown), images to rebuild, and a remediation curve down to zero.  
Same limitations: runtime version only, and no visibility without OneAgent.

 ![cve-node](https://global.discourse-cdn.com/dynatrace/original/3X/1/3/13c8bfc247369e9b94d5b938da8faf156ef5a03f.jpeg)

🔗 Here’s the link to download our dashboard for free from our GitHub : [https://github.com/packet-perf/dt-pp-dashboard-Node2Shell](https://dashboard's%20link)