Blog: BORIS for SolidWorks - Secure Your CAD Designs

Node2Shell: Dassault Systèmes Says Only Tuleap Is Affected So Far. What SOLIDWORKS Teams Should Check in Their Own Node.js Portals and Scripts | SolidWorks | Register and Certify IP of CAD design

2026-10-30 14:44 News
On 30 October 2026, Dassault Systèmes published a security advisory on Node2Shell (CVE-2026-111497), a critical flaw in the Brotli decompression code that ships inside Node.js. Dassault says its cybersecurity team has been checking its products since 23 October and that, as of now, the only affected product it has identified is Tuleap Enterprise Edition 17.5. The flaw itself is not a Dassault problem: CISA added it to its catalogue of exploited vulnerabilities on 27 October.
For most SOLIDWORKS users, that is reassuring news about Dassault's own software. Dassault's advisory names no SOLIDWORKS, PDM or 3DEXPERIENCE product as affected, and it published a similar advisory on the PHP2Shell flaws one day earlier, with the same result: only Tuleap 17.5.
But Node.js is not only used by software vendors. Product configurators, quote request forms, supplier portals, internal dashboards and automation scripts that move CAD data around are often built on it. Those tools are yours, not Dassault's, and no vendor advisory will patch them for you. Here is what is confirmed, what is not, and what SOLIDWORKS teams should check this week.
TL;DR: Dassault's products look clear so far, your own Node.js tools may not be

Node2Shell is an out-of-bounds write in the Brotli decoder used by Node.js and other software. Crafted compressed data can crash a process, leak its memory or, in some setups, run code. Node.js fixed it on 21 October in versions 26.12.1, 24.22.1 and 22.23.4. CISA lists it as exploited, with a federal deadline of 10 November. Dassault says only Tuleap Enterprise Edition 17.5 is affected among its products so far. SOLIDWORKS teams should find every Node.js app, portal and script that touches design data, update it, check Python and .NET tools too, and keep their own dated proof of their designs in case a server that holds them is breached.

What did Dassault Systèmes say about Node2Shell?

The Dassault Systèmes advisory for CVE-2026-111497 was published on its Trust Center on 30 October. It says the company is aware of the critical Node.js vulnerability and that its cybersecurity team, working under a NIST-based vulnerability management programme, has been investigating possible impact on its solutions since Friday 23 October.
  • Affected product so far: Tuleap Enterprise Edition 17.5, the application lifecycle management (ALM) tool used for software development and requirements tracking. Dassault links to remediation information for it.
  • Severity: Critical.
  • Other products: Dassault says up-to-date details for all its products are kept in a dedicated Support Knowledge Base article. The public advisory lists no SOLIDWORKS, SOLIDWORKS PDM, eDrawings or 3DEXPERIENCE product.
  • The wording matters: Dassault writes "as of now". The investigation is a running process, so check the advisory again before you close the topic.
One day earlier, on 29 October, Dassault published the same kind of advisory for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the PHP flaws disclosed a week before. There too, Tuleap Enterprise Edition 17.5 was the only affected Dassault product identified. Autodesk said something similar for its desktop products, as our sister site explains in its article on PHP2Shell and what it means for Inventor teams.

What is Node2Shell, and how serious is it?

Node2Shell, also called HTTP2Shell or Broccoli2Shell by different researchers, is a bug in Google's Brotli decoder. Brotli is a compression format used on the web, and its decoder is built into Node.js and many other programs. The Node.js security release of 21 October describes the risk in one sentence: "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution."
The key facts, as reported by Node.js, CISA and security firms:
  • Fixed Node.js versions: 26.12.1, 24.22.1 and 22.23.4. Node.js says end-of-life versions are always affected when it ships a security release, so old lines such as 20.x get no fix.
  • Severity: Node.js rates it High. Google's score on the CVE record is 9.2 (CVSS 4.0, Critical). Microsoft scored it 8.1.
  • Who found it: Node.js credits OpenAI Codex Security researchers. According to SecurityWeek, OpenAI said the root cause was fixed in the Brotli source code in February, without anyone knowing then that it was a security bug.
  • Library versions: Brotli 1.0.3 to 1.2.0 are affected, fixed in 1.0.10, 1.1.1 and 1.2.1.
  • Exploitation: CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 27 October, with a deadline of 10 November for US federal agencies, but gave no details about attacks. Honeypot operators logged attempts on 26 and 27 October. ELLIO reported that the exploit it saw was broken and produced no shell, while warning that failed attempts can still crash the target, which is a denial of service.
  • Proof of code execution: Imperva and ELLIO both reported running code on official Node.js builds in test setups. Neither published a working exploit.

When is a Node.js application actually exposed?

Not every Node.js program is at risk. The danger exists when the application decompresses Brotli data that an attacker can control. Akamai's analysis of 26 October lists three common paths:
  • Direct decompression: code that passes untrusted input to zlib.brotliDecompress() or zlib.createBrotliDecompress().
  • Downloads with fetch(): the built-in fetch() decompresses Brotli responses automatically, so a malicious or compromised server can attack the client that downloads from it. A script that pulls part files or catalogue data from a website is a client.
  • Express 5 and body-parser 2: their json, raw, text and urlencoded parsers decompress request bodies sent with Content-Encoding: br by default. A web form or API built this way can be attacked by anyone who can send it a request.
A bare Node.js HTTP server does not decode incoming Brotli bodies on its own, Akamai says. That is why the real question is not "do we run Node.js?" but "which of our Node.js tools decompress data from outside?" Akamai also says its telemetry shows affected Node.js versions in 61% of the networks it sees, so the answer is rarely "none".
The same decoder is used outside Node.js. Microsoft shipped fixes on 25 October for .NET 8, 9 and 10, Visual Studio 2019, 2022 and 2026, and PowerShell 7.4 to 7.6. The Python packages Brotli and brotlicffi were fixed in version 1.2.1, and Bun, Envoy and Istio were updated too. Broadcom said on 27 October that VMware SDDC Manager is affected, and Palo Alto Networks is rolling out PAN-OS hotfixes.
If a server that holds your models is breached, can you still prove they are yours?

BORIS for SOLIDWORKS registers parts, assemblies and drawings with a blockchain timestamp and a certificate of ownership, from inside SOLIDWORKS. Your proof stays valid whatever happens to a portal, a server or a vendor account.

👉 See how BORIS for SOLIDWORKS works

Where could Node2Shell sit around your SOLIDWORKS data?

Dassault checked Dassault software. Nobody has checked the tools your company, your reseller or your web agency built around it. In a typical SOLIDWORKS company, look at these places first:
  • Web configurators and quote forms that accept uploaded STEP files or drawings, or that serve 3D previews of your products.
  • Supplier and customer portals where drawings, models and change orders are exchanged. Our guide to supplier collaboration security in manufacturing explains why these portals matter.
  • Internal dashboards and integrations that read PDM, ERP or 3DEXPERIENCE data through APIs. A leaked process memory can contain the API keys and session tokens these tools use, which is a reason to treat SOLIDWORKS API security and API security for CAD tools as part of patching.
  • Automation scripts that download libraries, catalogue parts or supplier data with fetch(), or AI agents and connectors that move files between systems, like the ones in our article on SOLIDWORKS MCP servers and AI agents.
  • Developer machines where add-ins, macros and PDM tools are built in Visual Studio, and Python scripts that use the Brotli package.
Each of these sits next to design data. A crash takes a portal offline; a memory leak or code execution can hand an attacker the credentials to the vault behind it. Ransomware groups already list CAD drawings as loot, as we showed in our article on ransomware groups and CAD drawings.

Which versions fix Node2Shell?

Use this table to check the components most likely to be found in and around a SOLIDWORKS environment.
ComponentAffectedFixed inWhere you may find it
Node.js 26.x / 24.x / 22.xBefore the fixed releases26.12.1 / 24.22.1 / 22.23.4Web apps, portals, configurators, scripts
Node.js 25.x, 23.x, 20.x and olderAlways (end of life)No fix: move to a supported lineOld internal tools nobody updated
Google Brotli library1.0.3 to 1.2.01.0.10, 1.1.1, 1.2.1Software that bundles the decoder
Python Brotli / brotlicffiBefore 1.2.11.2.1 / 1.2.1.0Engineering and data scripts
.NET, Visual Studio, PowerShellVersions before 25 October updatesMicrosoft updates of 25 OctoberAdd-in and PDM tool development
Tuleap Enterprise Edition (Dassault)17.5See Dassault remediation informationSoftware and requirements teams

What should SOLIDWORKS teams do now?

You do not need to wait for a SOLIDWORKS update. These eight steps cover what is in your own hands.
  1. Make a list. Ask IT, your web agency and your reseller which of your systems run Node.js, including portals, configurators, dashboards and scripts. Include the tools nobody owns any more.
  2. Update Node.js. Move every supported line to 26.12.1, 24.22.1 or 22.23.4 or later. Replace end-of-life versions; there is no patch for them, and Node.js offers no workaround.
  3. Start with what faces the internet. Patch public forms, upload pages and supplier portals first, then internal tools. Our CAD security checklist for engineering teams helps you rank systems by the data they hold.
  4. Turn off compressed request bodies where you can. For Express and body-parser apps that cannot be updated today, Akamai notes that setting the inflate option to false makes compressed requests fail with HTTP 415.
  5. Check the other runtimes. Install Microsoft's .NET, Visual Studio and PowerShell updates on developer machines, and update Python Brotli and brotlicffi to 1.2.1 in engineering scripts.
  6. Rotate secrets on exposed servers. If a public Node.js app ran an affected version, change the API keys, tokens and service passwords it uses to reach PDM, ERP or your 3DEXPERIENCE tenant. Our SOLIDWORKS PDM security configuration guide covers vault accounts and permissions.
  7. Watch Dassault's advisory and KB article. Dassault says "as of now". If you use Tuleap, apply its remediation; if you run on-premises Dassault software, ask your reseller to confirm status from the Support Knowledge Base.
  8. Keep dated proof of your designs. Patching protects servers, not ownership. Register key models and drawings with an independent timestamp so you can show what you created, and when, even if copies leak. See blockchain timestamping for IP and how to prove authorship of CAD designs.

Why does a web flaw matter for CAD data?

Engineering data no longer lives only on the CAD workstation and the PDM vault. It moves through portals, previews, quoting tools, cloud tenants and scripts, and each step adds software that someone has to patch. The Helix attacks on SharePoint showed how quickly shared files can be copied once an attacker is in, and the new cross-company collaboration in SOLIDWORKS Design 2027 brings even more outside access to your platform.
Node2Shell is also a lesson in timing. The Brotli bug was fixed quietly in February and only recognised as a security hole in October, when it was already in many products. Vendors like Dassault and Microsoft then needed days to check and patch their own software. Your in-house tools will not get that attention unless you ask for it. For broader guidance, see our articles on SOLIDWORKS cloud security and SOLIDWORKS plugin security best practices.

How does this fit the bigger picture for CAD users?

Across our network this week, the same theme comes up: the weak point is often a tool around the design data, not the CAD system itself.

Conclusion

Dassault Systèmes says that, as of 30 October, Node2Shell affects only Tuleap Enterprise Edition 17.5 among its products, just as with PHP2Shell a day earlier. That is good news for SOLIDWORKS users. But the flaw is real, listed as exploited by CISA and present in Node.js, .NET, Python packages and network gear.
The work for SOLIDWORKS teams is outside the CAD software: find the Node.js portals, forms, dashboards and scripts that touch design data, update them before 10 November, rotate the secrets they hold, and keep independent, dated proof of the designs those systems carry.
Make your SOLIDWORKS designs provably yours, whatever server they pass through.

BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files, so you keep independent, dated proof of your designs in PDM, on the 3DEXPERIENCE platform, in a supplier portal or anywhere else.

👉 Get BORIS for SOLIDWORKS

FAQ: Node2Shell (CVE-2026-111497) and SOLIDWORKS

Is SOLIDWORKS affected by Node2Shell?

Dassault Systèmes' advisory of 30 October 2026 does not list SOLIDWORKS. It says that, as of now, the only affected Dassault product identified is Tuleap Enterprise Edition 17.5, and that up-to-date details for all products are in a Support Knowledge Base article.

What is CVE-2026-111497?

It is an out-of-bounds write in Google's Brotli decoder, nicknamed Node2Shell. An attacker who can make an application decompress crafted Brotli data can crash it, read process memory or, in some setups, run code.

Which Node.js versions fix it?

Node.js 26.12.1, 24.22.1 and 22.23.4, released on 21 October 2026. End-of-life lines such as 20.x, 23.x and 25.x get no fix and should be replaced.

Is Node2Shell being exploited?

CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026, with a 10 November deadline for US federal agencies, but gave no attack details. Honeypots logged attempts on 26 and 27 October, and one analysis found the exploit used there was broken.

Does every Node.js server need to panic?

No. The risk exists where an application decompresses Brotli data from outside, for example through zlib, the built-in fetch() or Express 5 and body-parser 2 request parsing. Updating is still the only complete fix.

Are .NET and Python tools affected too?

The same decoder is used elsewhere. Microsoft released .NET, Visual Studio and PowerShell updates on 25 October, and the Python Brotli and brotlicffi packages were fixed in version 1.2.1.

What is Tuleap?

Tuleap is application lifecycle management software for agile development, requirements and test tracking. Dassault Systèmes lists Tuleap Enterprise Edition in its own security advisories.

How does BORIS for SOLIDWORKS help with a vulnerability like this?

It does not patch servers. It gives you a blockchain-timestamped certificate of ownership for your CAD files, so if a portal or server holding your models is breached, you can still prove what you created and when.