I'm alkizz from Dumb But Secure, and I registered nodejs2shell.com on Nov 5 to join in on the fun.
It's a domain in the spirit of nginx2shell.com, part of the October run of *2shell names that people registered faster than anyone could find bugs to put on them. I liked the name, so here it is, doing nothing at all. If a real nodejs2shell ever shows up, they can have it!
If you came here looking for something real, there are two places worth your time. The Node.js project says it will ship security releases for the 26.x, 24.x and 22.x lines on or shortly after, Wednesday, November 11, 2026, and the highest severity issue it lists is HIGH. The details aren't public yet, so the useful move is to plan an upgrade and read their page when it lands.
And nginx already fixed a real one, CVE-2026-97205, a use-after-free with AIO and SSI, in 1.30.6 and 1.31.7 back on Oct 14. If you haven't upgraded, that's a better use of the next five minutes than this page.
If you're searching for the others too, here's the short version. php2shell.com is the real one, and it's the name everyone else copied. It's Wiz Research's disclosure site for two PHP bugs, CVE-2026-109618 and CVE-2026-109619, which PHP fixed on Oct 21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so if you run PHP and haven't upgraded, start here.
nginx2shell.com is a joke with a prize, a domain-bounty gag from Previdian that says up front no vulnerability is being announced, and apache2shell.com just says it's under construction, with no CVE or advisory on it. star2shell.com keeps the timeline if you want to watch the names pile up.
This site isn't affiliated with Node.js or the OpenJS Foundation, and it doesn't speak for them.